# CVEs published 2026-09-15 1,426 CVEs were published on September 15, 2026: 201 critical, 835 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2026-92184](https://cve.now/CVE-2026-92184.md): ag-ui-protocol ag-ui Multimodal Content utils.py urllib.request.urlopen server-side request forgery (CVSS 5.3, ag-ui-protocol ag-ui) - [CVE-2026-15640](https://cve.now/CVE-2026-15640.md): Authentication Bypass via SAML Response Manipulation (CVSS 9.5, Delinea Secret Server) - [CVE-2026-15639](https://cve.now/CVE-2026-15639.md): Reflected Cross-Site Scripting (CVSS 9.3, Delinea Secret Server) - [CVE-2026-15638](https://cve.now/CVE-2026-15638.md): Cryptographic Padding Oracle (CVSS 9.1, Delinea Secret Server) - [CVE-2026-73460](https://cve.now/CVE-2026-73460.md): Security Advisory 0160 (CVSS 6.1, Arista Networks EOS) - [CVE-2026-73459](https://cve.now/CVE-2026-73459.md): Security Advisory 0160 (CVSS 7.4, Arista Networks EOS) - [CVE-2026-73446](https://cve.now/CVE-2026-73446.md): Security Advisory 0160 (CVSS 7.4, Arista Networks EOS) - [CVE-2025-11395](https://cve.now/CVE-2025-11395.md): Podman: arbitrary file write when importing oci archive (CVSS 5.5, Red Hat Enterprise Linux · Red Hat Hardened Images +2) - [CVE-2026-85893](https://cve.now/CVE-2026-85893.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Edge) - [CVE-2026-69486](https://cve.now/CVE-2026-69486.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Edge) - [CVE-2026-92248](https://cve.now/CVE-2026-92248.md): Gimp: integer overflow when generating a thumbnail preview for a psd file (CVSS 7.8, GNOME GIMP · Red Hat Enterprise Linux) - [CVE-2026-92257](https://cve.now/CVE-2026-92257.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinks (CVSS 5.1, Netcore NR255-V) - [CVE-2026-92256](https://cve.now/CVE-2026-92256.md): Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd\_config\_show.cgi Read Handlers (CVSS 7.1, Netcore NR255-V) - [CVE-2026-92255](https://cve.now/CVE-2026-92255.md): Netcore NR255-V 1.5.130703 Out-of-Bounds Read in filter\_arp\_put\_file.cgi via String API Misuse (CVSS 5.3, Netcore NR255-V) - [CVE-2026-76873](https://cve.now/CVE-2026-76873.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP and ARP Hostname Fields (CVSS 5.1, Netcore NR255-V) - [CVE-2026-76872](https://cve.now/CVE-2026-76872.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP/ACL Management Pages (CVSS 5.1, Netcore NR255-V) - [CVE-2026-76871](https://cve.now/CVE-2026-76871.md): Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via VPN Read Handlers (CVSS 7.1, Netcore NR255-V) - [CVE-2026-76870](https://cve.now/CVE-2026-76870.md): Netcore NR255-V 1.5.130703 Out-of-Bounds Read in mtd\_write Firmware Upload Validation (CVSS 7.1, Netcore NR255-V) - [CVE-2026-76869](https://cve.now/CVE-2026-76869.md): Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in reboot\_timer\_set.cgi (CVSS 8.6, Netcore NR255-V) - [CVE-2026-76868](https://cve.now/CVE-2026-76868.md): Netcore NR255-V 1.5.130703 NULL Pointer Dereference in route\_policy\_add.cgi via Missing exit\_port (CVSS 6.9, Netcore NR255-V) - [CVE-2026-76867](https://cve.now/CVE-2026-76867.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in Route/NAT Configuration CGI Handlers (CVSS 5.1, Netcore NR255-V) - [CVE-2026-76866](https://cve.now/CVE-2026-76866.md): Netcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS Parameters (CVSS 8.6, Netcore NR255-V) - [CVE-2026-76865](https://cve.now/CVE-2026-76865.md): Netcore NR255-V 1.5.130703 NULL Pointer Dereference via Unchecked atoi() in QoS Setter Handlers (CVSS 6.9, Netcore NR255-V) - [CVE-2026-76864](https://cve.now/CVE-2026-76864.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via Unescaped QoS Rule Names (CVSS 4.8, Netcore NR255-V) - [CVE-2026-76863](https://cve.now/CVE-2026-76863.md): Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via QoS Bandwidth Plan Routes (CVSS 5.3, Netcore NR255-V) - [CVE-2026-76862](https://cve.now/CVE-2026-76862.md): Netcore NR255-V 1.5.130703 OS Command Argument Injection in Nettools tcpdump Launch Paths (CVSS 8.7, Netcore NR255-V) - [CVE-2026-76861](https://cve.now/CVE-2026-76861.md): Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in ntools\_tcpdump\_start\_set.cgi (CVSS 8.7, Netcore NR255-V) - [CVE-2026-76860](https://cve.now/CVE-2026-76860.md): Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in wake\_up\_set.cgi via MAC and ID Tokenization (CVSS 8.7, Netcore NR255-V) - [CVE-2026-76859](https://cve.now/CVE-2026-76859.md): Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via user\_pass\_show.cgi (CVSS 7.1, Netcore NR255-V) - [CVE-2026-76858](https://cve.now/CVE-2026-76858.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns\_wan\_list\_show.cgi (CVSS 4.8, Netcore NR255-V) - [CVE-2026-76857](https://cve.now/CVE-2026-76857.md): Netcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns\_wan\_list\_show.cgi (CVSS 7.1, Netcore NR255-V) - [CVE-2026-76856](https://cve.now/CVE-2026-76856.md): Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints (CVSS 7.0, Netcore NR255-V) - [CVE-2026-76855](https://cve.now/CVE-2026-76855.md): Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints (CVSS 7.1, Netcore NR255-V) - [CVE-2026-76854](https://cve.now/CVE-2026-76854.md): Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7\_web\_auth\_user\_show.cgi (CVSS 7.1, Netcore NR255-V) - [CVE-2026-76853](https://cve.now/CVE-2026-76853.md): Netcore NR268 1.7.121109 Security Check Bypass in parame\_put\_file.cgi (CVSS 7.2, Netcore NR268) - [CVE-2026-76852](https://cve.now/CVE-2026-76852.md): Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd\_write (CVSS 8.7, Netcore NR268) - [CVE-2026-83368](https://cve.now/CVE-2026-83368.md): Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM product of Oracle Java SE (component… (CVSS 7.0, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition,…) - [CVE-2026-83408](https://cve.now/CVE-2026-83408.md): Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). (CVSS 8.1, Oracle GraalVM for JDK, Oracle GraalVM) - [CVE-2026-83357](https://cve.now/CVE-2026-83357.md): Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). (CVSS 8.1, Oracle GraalVM for JDK, Oracle GraalVM) - [CVE-2026-82567](https://cve.now/CVE-2026-82567.md): mySCADA myPRO Manager Missing Authorization (CVSS 6.3, mySCADA Technologies mySCADA myPRO) - [CVE-2026-73807](https://cve.now/CVE-2026-73807.md): mySCADA myPRO Manager Missing Authorization (CVSS 9.8, mySCADA Technologies mySCADA myPRO) - [CVE-2026-92259](https://cve.now/CVE-2026-92259.md): Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache… (CVSS 5.5, Samsung Opensource Escargot) - [CVE-2026-81855](https://cve.now/CVE-2026-81855.md): Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key (CVSS 9.1, Wärtsilä FOS-Onboard) - [CVE-2026-92114](https://cve.now/CVE-2026-92114.md): a2ui-project a2ui Basic Catalog safe\_regex.ts redos (CVSS 6.9, a2ui-project a2ui) - [CVE-2026-78225](https://cve.now/CVE-2026-78225.md): Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key (CVSS 9.0, Wärtsilä FOS-Onboard) - [CVE-2026-73444](https://cve.now/CVE-2026-73444.md): On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated… (CVSS 4.7, Arista Networks EOS) - [CVE-2026-61560](https://cve.now/CVE-2026-61560.md): @zereight/mcp-gitlab's unauthenticated arbitrary file read via \`upload\_markdown\` enables PAT exfiltration and full account takeover (CVSS 9.8, zereight gitlab-mcp · @zereight/mcp-gitlab) - [CVE-2026-73437](https://cve.now/CVE-2026-73437.md): On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker… (CVSS 9.6, Arista Networks EOS) - [CVE-2026-10144](https://cve.now/CVE-2026-10144.md): Rsbuild \< 2.0.9 Command Injection via openBrowser() URL Handling (CVSS 7.1, web-infra-dev rsbuild) - [CVE-2026-68491](https://cve.now/CVE-2026-68491.md): An insufficient check allowed for the overwrite of arbitrary files via a symlink. (CVSS 9.4, Webpros SolusVM) - [CVE-2026-61559](https://cve.now/CVE-2026-61559.md): @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery (CVSS 9.6, zereight gitlab-mcp · @zereight/mcp-gitlab) - [CVE-2026-19655](https://cve.now/CVE-2026-19655.md): On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information… (CVSS 6.5, Arista Networks EOS) - [CVE-2026-92234](https://cve.now/CVE-2026-92234.md): QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors (CVSS 5.1, Webkul QloApps) - [CVE-2026-92000](https://cve.now/CVE-2026-92000.md): adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size (CVSS 8.7, cthackers adm-zip · adm-zip) - [CVE-2026-91939](https://cve.now/CVE-2026-91939.md): Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter (CVSS 9.3, Cotonti) - [CVE-2026-61568](https://cve.now/CVE-2026-61568.md): @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport (CVSS 9.6, zereight gitlab-mcp · @zereight/mcp-gitlab) - [CVE-2026-61554](https://cve.now/CVE-2026-61554.md): emp3r0r has an unauthenticated HTTP Polling DoS (CVSS 7.5, jm33-m0 emp3r0r · github.com/jm33-m0/emp3r0r/core) - [CVE-2026-91719](https://cve.now/CVE-2026-91719.md): Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (CVSS 4.3, Google Chrome) - [CVE-2026-91722](https://cve.now/CVE-2026-91722.md): Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside… (CVSS 8.8, Google Chrome) - [CVE-2026-91730](https://cve.now/CVE-2026-91730.md): Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer… (CVSS 3.1, Google Chrome) - [CVE-2026-91738](https://cve.now/CVE-2026-91738.md): Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code o (CVSS 9.6, Google Chrome) - [CVE-2026-91713](https://cve.now/CVE-2026-91713.md): Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer… (CVSS 4.2, Google Chrome) - [CVE-2026-91739](https://cve.now/CVE-2026-91739.md): Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the… (CVSS 4.2, Google Chrome) - [CVE-2026-91725](https://cve.now/CVE-2026-91725.md): Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a… (CVSS 5.3, Google Chrome) - [CVE-2026-91714](https://cve.now/CVE-2026-91714.md): Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to leak… (CVSS 5.3, Google Chrome) - [CVE-2026-91742](https://cve.now/CVE-2026-91742.md): Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering… (CVSS 4.8, Google Chrome) - [CVE-2026-91732](https://cve.now/CVE-2026-91732.md): Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer… (CVSS 3.1, Google Chrome) - [CVE-2026-91723](https://cve.now/CVE-2026-91723.md): Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML… (CVSS 4.2, Google Chrome) - [CVE-2026-91745](https://cve.now/CVE-2026-91745.md): Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a… (CVSS 8.8, Google Chrome) - [CVE-2026-91715](https://cve.now/CVE-2026-91715.md): Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the… (CVSS 8.8, Google Chrome) - [CVE-2026-91711](https://cve.now/CVE-2026-91711.md): Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside… (CVSS 8.8, Google Chrome) - [CVE-2026-91737](https://cve.now/CVE-2026-91737.md): Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a… (CVSS 8.8, Google Chrome) - [CVE-2026-91729](https://cve.now/CVE-2026-91729.md): Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to exec (CVSS 9.6, Google Chrome) - [CVE-2026-91746](https://cve.now/CVE-2026-91746.md): Integer overflow in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a… (CVSS 4.3, Google Chrome) - [CVE-2026-91716](https://cve.now/CVE-2026-91716.md): Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a (CVSS 9.6, Google Chrome) - [CVE-2026-91718](https://cve.now/CVE-2026-91718.md): Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a (CVSS 9.6, Google Chrome) - [CVE-2026-91710](https://cve.now/CVE-2026-91710.md): Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the san (CVSS 9.6, Google Chrome) - [CVE-2026-91740](https://cve.now/CVE-2026-91740.md): Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted… (CVSS 4.3, Google Chrome) - [CVE-2026-91736](https://cve.now/CVE-2026-91736.md): Use after free in DOM in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a… (CVSS 8.8, Google Chrome) - [CVE-2026-91708](https://cve.now/CVE-2026-91708.md): Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to… (CVSS 3.1, Google Chrome) - [CVE-2026-91735](https://cve.now/CVE-2026-91735.md): Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer… (CVSS 8.3, Google Chrome) - [CVE-2026-91717](https://cve.now/CVE-2026-91717.md): Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive… (CVSS 5.1, Google Chrome) - [CVE-2026-91709](https://cve.now/CVE-2026-91709.md): Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the… (CVSS 8.8, Google Chrome) - [CVE-2026-91741](https://cve.now/CVE-2026-91741.md): Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the… (CVSS 8.8, Google Chrome) - [CVE-2026-91733](https://cve.now/CVE-2026-91733.md): Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer… (CVSS 8.3, Google Chrome) - [CVE-2026-91747](https://cve.now/CVE-2026-91747.md): Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to… (CVSS 3.1, Google Chrome) - [CVE-2026-91731](https://cve.now/CVE-2026-91731.md): Type confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the… (CVSS 8.8, Google Chrome) - [CVE-2026-91720](https://cve.now/CVE-2026-91720.md): Uninitialized resource in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a… (CVSS 4.7, Google Chrome) - [CVE-2026-91748](https://cve.now/CVE-2026-91748.md): Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer… (CVSS 8.3, Google Chrome) - [CVE-2026-91712](https://cve.now/CVE-2026-91712.md): Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer… (CVSS 8.3, Google Chrome) - [CVE-2026-91744](https://cve.now/CVE-2026-91744.md): Race condition in PlatformIntegration in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the… (CVSS 5.3, Google Chrome) - [CVE-2026-91743](https://cve.now/CVE-2026-91743.md): Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome) - [CVE-2026-91727](https://cve.now/CVE-2026-91727.md): Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had… (CVSS 8.1, Google Chrome) - [CVE-2026-91734](https://cve.now/CVE-2026-91734.md): Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execute arbitrary code… (CVSS 7.4, Google Chrome) - [CVE-2026-91728](https://cve.now/CVE-2026-91728.md): Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a (CVSS 9.6, Google Chrome) - [CVE-2026-91724](https://cve.now/CVE-2026-91724.md): Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome) - [CVE-2026-91749](https://cve.now/CVE-2026-91749.md): Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside th (CVSS 9.6, Google Chrome) - [CVE-2026-91721](https://cve.now/CVE-2026-91721.md): Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code… (CVSS 8.8, Google Chrome) - [CVE-2026-91726](https://cve.now/CVE-2026-91726.md): Out of bounds read in WebGL in Google Chrome on on Android prior to 153.0.8010.47 allowed a remote attacker to read memory outside the… (CVSS 4.7, Google Chrome) - [CVE-2026-66372](https://cve.now/CVE-2026-66372.md): Predictable Seed in Pseudo-Random Number Generator (PRNG) in Digital Watchdog VMAX DVR and NVR Product Lineups (CVSS 6.8, Digital Watchdog VMAX A1 G4 DVR · Digital Watchdog VMAX… +3) - [CVE-2026-66887](https://cve.now/CVE-2026-66887.md): Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups (CVSS 9.6, Digital Watchdog VMAX A1 G4 DVR · Digital Watchdog VMAX… +3) - [CVE-2026-79994](https://cve.now/CVE-2026-79994.md): Docker Sandboxes UDS forwarder can reach arbitrary host Unix sockets through a symlink race (CVSS 8.7, Docker Sandboxes) - [CVE-2026-68950](https://cve.now/CVE-2026-68950.md): Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups (CVSS 8.8, Digital Watchdog VMAX A1 G4 DVR · Digital Watchdog VMAX… +3) - [CVE-2026-68070](https://cve.now/CVE-2026-68070.md): Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups (CVSS 8.8, Digital Watchdog VMAX A1 G4 DVR · Digital Watchdog VMAX… +3) - [CVE-2026-54544](https://cve.now/CVE-2026-54544.md): Fireshare has unauthenticated SSRF via missing login\_required on webhook test endpoints (CVSS 7.2, ShaneIsrael fireshare) - [CVE-2026-66890](https://cve.now/CVE-2026-66890.md): Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups (CVSS 9.6, Digital Watchdog VMAX A1 G4 DVR · Digital Watchdog VMAX… +3) - [CVE-2026-54337](https://cve.now/CVE-2026-54337.md): Fireshare has Unauthenticated Argument Injection to Arbitrary File Write/Overwrite (CVSS 9.8, ShaneIsrael fireshare) - [CVE-2026-81927](https://cve.now/CVE-2026-81927.md): Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode (CVSS 1.8, Concrete CMS) - [CVE-2026-68953](https://cve.now/CVE-2026-68953.md): Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups (CVSS 6.5, Digital Watchdog VMAX A1 G4 DVR · Digital Watchdog VMAX… +3) - [CVE-2026-88065](https://cve.now/CVE-2026-88065.md): \`tts-be\` application has a Broken Access Control vulnerability (CVSS 7.5, NIAEFEUP tts-be) - [CVE-2026-18426](https://cve.now/CVE-2026-18426.md): Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit (CVSS 2.0, Concrete CMS) - [CVE-2026-92237](https://cve.now/CVE-2026-92237.md): Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and… (CVSS 6.5, Devolutions PowerShell Universal) - [CVE-2026-81926](https://cve.now/CVE-2026-81926.md): Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog (CVSS 2.0, Concrete CMS) - [CVE-2026-81925](https://cve.now/CVE-2026-81925.md): Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format (CVSS 2.1, Concrete CMS) - [CVE-2026-87289](https://cve.now/CVE-2026-87289.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-static-content). (CVSS 7.5, Oracle Helidon) - [CVE-2026-87285](https://cve.now/CVE-2026-87285.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox) - [CVE-2026-87284](https://cve.now/CVE-2026-87284.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 3.2, Oracle VM VirtualBox) - [CVE-2026-87283](https://cve.now/CVE-2026-87283.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox) - [CVE-2026-87282](https://cve.now/CVE-2026-87282.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox) - [CVE-2026-87281](https://cve.now/CVE-2026-87281.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 3.2, Oracle VM VirtualBox) - [CVE-2026-87280](https://cve.now/CVE-2026-87280.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 4.2, Oracle VM VirtualBox) - [CVE-2026-87279](https://cve.now/CVE-2026-87279.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.1, Oracle VM VirtualBox) - [CVE-2026-87278](https://cve.now/CVE-2026-87278.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.1, Oracle VM VirtualBox) - [CVE-2026-87277](https://cve.now/CVE-2026-87277.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.5, Oracle VM VirtualBox) - [CVE-2026-87276](https://cve.now/CVE-2026-87276.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.5, Oracle VM VirtualBox) - [CVE-2026-87275](https://cve.now/CVE-2026-87275.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 4.6, Oracle VM VirtualBox) - [CVE-2026-87274](https://cve.now/CVE-2026-87274.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 4.4, Oracle VM VirtualBox) - [CVE-2026-87273](https://cve.now/CVE-2026-87273.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.6, Oracle VM VirtualBox) - [CVE-2026-87272](https://cve.now/CVE-2026-87272.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.8, Oracle VM VirtualBox) - [CVE-2026-87271](https://cve.now/CVE-2026-87271.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.8, Oracle VM VirtualBox) - [CVE-2026-87270](https://cve.now/CVE-2026-87270.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.8, Oracle VM VirtualBox) - [CVE-2026-87269](https://cve.now/CVE-2026-87269.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.8, Oracle VM VirtualBox) - [CVE-2026-87268](https://cve.now/CVE-2026-87268.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.8, Oracle VM VirtualBox) - [CVE-2026-87267](https://cve.now/CVE-2026-87267.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 5.3, Oracle VM VirtualBox) - [CVE-2026-87266](https://cve.now/CVE-2026-87266.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). (CVSS 8.2, Oracle Agile PLM) - [CVE-2026-87265](https://cve.now/CVE-2026-87265.md): Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). (CVSS 8.1, Oracle Purchasing) - [CVE-2026-87264](https://cve.now/CVE-2026-87264.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). (CVSS 7.7, Oracle PeopleSoft Enterprise PeopleTools) - [CVE-2026-87262](https://cve.now/CVE-2026-87262.md): Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication… (CVSS 7.1, Oracle Agile Engineering Data Management) - [CVE-2026-87261](https://cve.now/CVE-2026-87261.md): Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication… (CVSS 7.3, Oracle Agile Engineering Data Management) - [CVE-2026-87260](https://cve.now/CVE-2026-87260.md): Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication… (CVSS 7.3, Oracle Agile Engineering Data Management) - [CVE-2026-87259](https://cve.now/CVE-2026-87259.md): Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication… (CVSS 8.4, Oracle Agile Engineering Data Management) - [CVE-2026-87258](https://cve.now/CVE-2026-87258.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). (CVSS 7.6, Oracle Agile PLM) - [CVE-2026-87257](https://cve.now/CVE-2026-87257.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: SDK). (CVSS 7.7, Oracle Agile PLM) - [CVE-2026-87256](https://cve.now/CVE-2026-87256.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). (CVSS 7.7, Oracle Agile PLM) - [CVE-2026-87254](https://cve.now/CVE-2026-87254.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). (CVSS 7.5, Oracle Agile PLM) - [CVE-2026-87253](https://cve.now/CVE-2026-87253.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Client). (CVSS 6.1, Oracle Agile PLM) - [CVE-2026-87252](https://cve.now/CVE-2026-87252.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). (CVSS 6.8, Oracle Agile PLM) - [CVE-2026-87250](https://cve.now/CVE-2026-87250.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.6, Oracle Hyperion Financial Management) - [CVE-2026-87249](https://cve.now/CVE-2026-87249.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.1, Oracle Hyperion Financial Management) - [CVE-2026-87248](https://cve.now/CVE-2026-87248.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 6.7, Oracle Hyperion Financial Management) - [CVE-2026-87247](https://cve.now/CVE-2026-87247.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management) - [CVE-2026-87246](https://cve.now/CVE-2026-87246.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.2, Oracle Hyperion Financial Management) - [CVE-2026-87245](https://cve.now/CVE-2026-87245.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.0, Oracle Hyperion Financial Management) - [CVE-2026-87244](https://cve.now/CVE-2026-87244.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.2, Oracle Hyperion Financial Management) - [CVE-2026-87243](https://cve.now/CVE-2026-87243.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.0, Oracle Hyperion Financial Management) - [CVE-2026-87242](https://cve.now/CVE-2026-87242.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.4, Oracle Hyperion Financial Management) - [CVE-2026-87241](https://cve.now/CVE-2026-87241.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.1, Oracle Hyperion Financial Management) - [CVE-2026-87240](https://cve.now/CVE-2026-87240.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.0, Oracle Hyperion Financial Management) - [CVE-2026-87239](https://cve.now/CVE-2026-87239.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.2, Oracle Hyperion Financial Management) - [CVE-2026-87238](https://cve.now/CVE-2026-87238.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management) - [CVE-2026-87237](https://cve.now/CVE-2026-87237.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management) - [CVE-2026-87236](https://cve.now/CVE-2026-87236.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.1, Oracle Hyperion Financial Management) - [CVE-2026-87235](https://cve.now/CVE-2026-87235.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.4, Oracle Hyperion Financial Management) - [CVE-2026-87234](https://cve.now/CVE-2026-87234.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.1, Oracle Hyperion Financial Management) - [CVE-2026-87233](https://cve.now/CVE-2026-87233.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.6, Oracle Hyperion Financial Management) - [CVE-2026-87232](https://cve.now/CVE-2026-87232.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.1, Oracle Hyperion Financial Management) - [CVE-2026-87231](https://cve.now/CVE-2026-87231.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.1, Oracle Hyperion Financial Management) - [CVE-2026-87230](https://cve.now/CVE-2026-87230.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 10.0, Oracle Hyperion Financial Management) - [CVE-2026-87229](https://cve.now/CVE-2026-87229.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.2, Oracle Hyperion Financial Management) - [CVE-2026-87228](https://cve.now/CVE-2026-87228.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.2, Oracle Hyperion Financial Management) - [CVE-2026-87227](https://cve.now/CVE-2026-87227.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management) - [CVE-2026-87226](https://cve.now/CVE-2026-87226.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management) - [CVE-2026-87225](https://cve.now/CVE-2026-87225.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.1, Oracle Hyperion Financial Management) - [CVE-2026-87224](https://cve.now/CVE-2026-87224.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management) - [CVE-2026-87223](https://cve.now/CVE-2026-87223.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.1, Oracle Hyperion Financial Management) - [CVE-2026-87222](https://cve.now/CVE-2026-87222.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management) - [CVE-2026-87221](https://cve.now/CVE-2026-87221.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management) - [CVE-2026-87220](https://cve.now/CVE-2026-87220.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.1, Oracle Hyperion Financial Management) - [CVE-2026-87219](https://cve.now/CVE-2026-87219.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.4, Oracle Hyperion Financial Management) - [CVE-2026-87218](https://cve.now/CVE-2026-87218.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.1, Oracle Hyperion Financial Management) - [CVE-2026-87217](https://cve.now/CVE-2026-87217.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.1, Oracle Hyperion Financial Management) - [CVE-2026-87216](https://cve.now/CVE-2026-87216.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.8, Oracle Hyperion Financial Management) - [CVE-2026-87215](https://cve.now/CVE-2026-87215.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management) - [CVE-2026-87214](https://cve.now/CVE-2026-87214.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.1, Oracle Hyperion Financial Management) - [CVE-2026-87213](https://cve.now/CVE-2026-87213.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.4, Oracle Hyperion Financial Management) - [CVE-2026-87212](https://cve.now/CVE-2026-87212.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.4, Oracle Hyperion Financial Management) - [CVE-2026-87211](https://cve.now/CVE-2026-87211.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management) - [CVE-2026-87210](https://cve.now/CVE-2026-87210.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.3, Oracle Hyperion Financial Management) - [CVE-2026-87209](https://cve.now/CVE-2026-87209.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.1, Oracle Hyperion Financial Management) - [CVE-2026-87208](https://cve.now/CVE-2026-87208.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.1, Oracle Hyperion Financial Management) - [CVE-2026-87207](https://cve.now/CVE-2026-87207.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.2, Oracle Hyperion Financial Management) - [CVE-2026-87206](https://cve.now/CVE-2026-87206.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.4, Oracle Hyperion Financial Management) - [CVE-2026-87205](https://cve.now/CVE-2026-87205.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management) - [CVE-2026-87204](https://cve.now/CVE-2026-87204.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management) - [CVE-2026-87203](https://cve.now/CVE-2026-87203.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management) - [CVE-2026-87202](https://cve.now/CVE-2026-87202.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management) - [CVE-2026-87201](https://cve.now/CVE-2026-87201.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management) - [CVE-2026-87200](https://cve.now/CVE-2026-87200.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.2, Oracle Hyperion Financial Management) - [CVE-2026-87199](https://cve.now/CVE-2026-87199.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management) - [CVE-2026-87198](https://cve.now/CVE-2026-87198.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.4, Oracle Hyperion Financial Management) - [CVE-2026-87197](https://cve.now/CVE-2026-87197.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.2, Oracle Hyperion Financial Management) - [CVE-2026-87196](https://cve.now/CVE-2026-87196.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.2, Oracle Hyperion Financial Management) - [CVE-2026-87195](https://cve.now/CVE-2026-87195.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.4, Oracle Hyperion Financial Management) - [CVE-2026-87194](https://cve.now/CVE-2026-87194.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management) - [CVE-2026-87193](https://cve.now/CVE-2026-87193.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management) - [CVE-2026-87192](https://cve.now/CVE-2026-87192.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.1, Oracle Hyperion Financial Management) - [CVE-2026-87191](https://cve.now/CVE-2026-87191.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.1, Oracle Hyperion Financial Management) - [CVE-2026-87190](https://cve.now/CVE-2026-87190.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management) - [CVE-2026-87189](https://cve.now/CVE-2026-87189.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.1, Oracle Hyperion Financial Management) - [CVE-2026-87188](https://cve.now/CVE-2026-87188.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.8, Oracle Hyperion Financial Management) - [CVE-2026-87187](https://cve.now/CVE-2026-87187.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management) - [CVE-2026-87186](https://cve.now/CVE-2026-87186.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.6, Oracle Hyperion Financial Management) - [CVE-2026-87185](https://cve.now/CVE-2026-87185.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management) - [CVE-2026-87184](https://cve.now/CVE-2026-87184.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.8, Oracle Hyperion Financial Management) - [CVE-2026-87183](https://cve.now/CVE-2026-87183.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.7, Oracle Hyperion Financial Management) - [CVE-2026-87182](https://cve.now/CVE-2026-87182.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management) - [CVE-2026-87181](https://cve.now/CVE-2026-87181.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management) - [CVE-2026-87180](https://cve.now/CVE-2026-87180.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management) - [CVE-2026-87179](https://cve.now/CVE-2026-87179.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management) - [CVE-2026-87178](https://cve.now/CVE-2026-87178.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.7, Oracle Hyperion Financial Management) - [CVE-2026-87177](https://cve.now/CVE-2026-87177.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.5, Oracle Hyperion Financial Management) - [CVE-2026-87176](https://cve.now/CVE-2026-87176.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.1, Oracle Hyperion Financial Management) - [CVE-2026-87175](https://cve.now/CVE-2026-87175.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.1, Oracle Hyperion Financial Management) - [CVE-2026-87174](https://cve.now/CVE-2026-87174.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.2, Oracle Hyperion Financial Management) - [CVE-2026-87173](https://cve.now/CVE-2026-87173.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.1, Oracle Hyperion Financial Management) - [CVE-2026-87172](https://cve.now/CVE-2026-87172.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.9, Oracle Hyperion Financial Management) - [CVE-2026-87171](https://cve.now/CVE-2026-87171.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.7, Oracle Hyperion Financial Management) - [CVE-2026-87170](https://cve.now/CVE-2026-87170.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.1, Oracle Hyperion Financial Management) - [CVE-2026-87169](https://cve.now/CVE-2026-87169.md): Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Wage… (CVSS 6.1, Oracle Contract Lifecycle Management for Public Sector) - [CVE-2026-87168](https://cve.now/CVE-2026-87168.md): Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing). (CVSS 8.1, Oracle Purchasing) - [CVE-2026-87167](https://cve.now/CVE-2026-87167.md): Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing). (CVSS 8.1, Oracle Purchasing) - [CVE-2026-87166](https://cve.now/CVE-2026-87166.md): Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). (CVSS 8.1, Oracle Purchasing) - [CVE-2026-87165](https://cve.now/CVE-2026-87165.md): Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: ECC For Award… (CVSS 8.8, Oracle Contract Lifecycle Management for Public Sector) - [CVE-2026-87164](https://cve.now/CVE-2026-87164.md): Vulnerability in the Oracle Banking Branch product of Oracle Financial Services Applications (component: Reports). (CVSS 8.0, Oracle Banking Branch) - [CVE-2026-87163](https://cve.now/CVE-2026-87163.md): Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). (CVSS 8.8, Oracle Purchasing) - [CVE-2026-87162](https://cve.now/CVE-2026-87162.md): Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). (CVSS 8.8, Oracle Contract Lifecycle Management for Public Sector) - [CVE-2026-87161](https://cve.now/CVE-2026-87161.md): Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.5, Oracle HRMS) - [CVE-2026-87160](https://cve.now/CVE-2026-87160.md): Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle HRMS) - [CVE-2026-87159](https://cve.now/CVE-2026-87159.md): Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle HRMS) - [CVE-2026-87158](https://cve.now/CVE-2026-87158.md): Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Enterprise Command Center). (CVSS 7.1, Oracle Order Management) - [CVE-2026-87157](https://cve.now/CVE-2026-87157.md): Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). (CVSS 8.1, Oracle Order Management) - [CVE-2026-87156](https://cve.now/CVE-2026-87156.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle Product Hub) - [CVE-2026-87155](https://cve.now/CVE-2026-87155.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Product Hub) - [CVE-2026-87154](https://cve.now/CVE-2026-87154.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Product Hub) - [CVE-2026-87153](https://cve.now/CVE-2026-87153.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Product Hub) - [CVE-2026-87152](https://cve.now/CVE-2026-87152.md): Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). (CVSS 8.1, Oracle Installed Base) - [CVE-2026-87151](https://cve.now/CVE-2026-87151.md): Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Setup Workbench). (CVSS 7.7, Oracle Bills of Material) - [CVE-2026-87150](https://cve.now/CVE-2026-87150.md): Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Setup Workbench). (CVSS 8.8, Oracle Bills of Material) - [CVE-2026-87149](https://cve.now/CVE-2026-87149.md): Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). (CVSS 7.1, Oracle Contract Lifecycle Management for Public Sector) - [CVE-2026-87148](https://cve.now/CVE-2026-87148.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.5, Oracle Hyperion Data Relationship Management) - [CVE-2026-87147](https://cve.now/CVE-2026-87147.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.7, Oracle Hyperion Data Relationship Management) - [CVE-2026-87146](https://cve.now/CVE-2026-87146.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.1, Oracle Hyperion Data Relationship Management) - [CVE-2026-87145](https://cve.now/CVE-2026-87145.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.3, Oracle Hyperion Data Relationship Management) - [CVE-2026-87144](https://cve.now/CVE-2026-87144.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.6, Oracle Hyperion Data Relationship Management) - [CVE-2026-87143](https://cve.now/CVE-2026-87143.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.4, Oracle Hyperion Data Relationship Management) - [CVE-2026-87142](https://cve.now/CVE-2026-87142.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.1, Oracle Hyperion Data Relationship Management) - [CVE-2026-87141](https://cve.now/CVE-2026-87141.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.7, Oracle Hyperion Data Relationship Management) - [CVE-2026-87140](https://cve.now/CVE-2026-87140.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.5, Oracle Hyperion Data Relationship Management) - [CVE-2026-87139](https://cve.now/CVE-2026-87139.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.5, Oracle Hyperion Data Relationship Management) - [CVE-2026-87138](https://cve.now/CVE-2026-87138.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.5, Oracle Hyperion Data Relationship Management) - [CVE-2026-87137](https://cve.now/CVE-2026-87137.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.6, Oracle Hyperion Data Relationship Management) - [CVE-2026-87136](https://cve.now/CVE-2026-87136.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.5, Oracle Hyperion Data Relationship Management) - [CVE-2026-87135](https://cve.now/CVE-2026-87135.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.1, Oracle Hyperion Data Relationship Management) - [CVE-2026-87134](https://cve.now/CVE-2026-87134.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.7, Oracle Hyperion Data Relationship Management) - [CVE-2026-87133](https://cve.now/CVE-2026-87133.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.6, Oracle Hyperion Data Relationship Management) - [CVE-2026-87132](https://cve.now/CVE-2026-87132.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.6, Oracle Hyperion Data Relationship Management) - [CVE-2026-87131](https://cve.now/CVE-2026-87131.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.6, Oracle Hyperion Data Relationship Management) - [CVE-2026-87130](https://cve.now/CVE-2026-87130.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.4, Oracle Hyperion Data Relationship Management) - [CVE-2026-87129](https://cve.now/CVE-2026-87129.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 9.1, Oracle Hyperion Data Relationship Management) - [CVE-2026-87128](https://cve.now/CVE-2026-87128.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 9.1, Oracle Hyperion Data Relationship Management) - [CVE-2026-87127](https://cve.now/CVE-2026-87127.md): Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing). (CVSS 7.7, Oracle Purchasing) - [CVE-2026-87126](https://cve.now/CVE-2026-87126.md): Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Reports Security). (CVSS 7.1, Oracle Report Manager) - [CVE-2026-87125](https://cve.now/CVE-2026-87125.md): Vulnerability in the Oracle Financials for Asia/Pacific product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.3, Oracle Financials for Asia/Pacific) - [CVE-2026-87124](https://cve.now/CVE-2026-87124.md): Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.7, Oracle iRecruitment) - [CVE-2026-83491](https://cve.now/CVE-2026-83491.md): Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations). (CVSS 6.8, Oracle iRecruitment) - [CVE-2026-83490](https://cve.now/CVE-2026-83490.md): Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.5, Oracle iRecruitment) - [CVE-2026-83489](https://cve.now/CVE-2026-83489.md): Vulnerability in the Oracle Banking Origination product of Oracle Financial Services Applications (component: Onboarding Batch Processes). (CVSS 7.5, Oracle Banking Origination) - [CVE-2026-83488](https://cve.now/CVE-2026-83488.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security). (CVSS 5.4, Oracle Helidon) - [CVE-2026-83487](https://cve.now/CVE-2026-83487.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). (CVSS 7.7, Oracle Product Hub) - [CVE-2026-83486](https://cve.now/CVE-2026-83486.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). (CVSS 7.7, Oracle Product Hub) - [CVE-2026-83485](https://cve.now/CVE-2026-83485.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). (CVSS 7.7, Oracle Product Hub) - [CVE-2026-83484](https://cve.now/CVE-2026-83484.md): Vulnerability in the Oracle US Federal Human Resources product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle US Federal Human Resources) - [CVE-2026-83483](https://cve.now/CVE-2026-83483.md): Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Self-serv What-if Analysis). (CVSS 8.0, Oracle Advanced Benefits) - [CVE-2026-83482](https://cve.now/CVE-2026-83482.md): Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Contracts) - [CVE-2026-83481](https://cve.now/CVE-2026-83481.md): Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Contracts) - [CVE-2026-83480](https://cve.now/CVE-2026-83480.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket). (CVSS 5.3, Oracle Helidon) - [CVE-2026-83479](https://cve.now/CVE-2026-83479.md): Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Contracts) - [CVE-2026-83477](https://cve.now/CVE-2026-83477.md): Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Workbenches). (CVSS 8.1, Oracle Work in Process) - [CVE-2026-83465](https://cve.now/CVE-2026-83465.md): Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). (CVSS 8.2, Oracle Mobile Application Server) - [CVE-2026-83464](https://cve.now/CVE-2026-83464.md): Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). (CVSS 8.1, Oracle Mobile Application Server) - [CVE-2026-83463](https://cve.now/CVE-2026-83463.md): Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). (CVSS 7.5, Oracle Mobile Application Server) - [CVE-2026-83462](https://cve.now/CVE-2026-83462.md): Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). (CVSS 9.8, Oracle Mobile Application Server) - [CVE-2026-83461](https://cve.now/CVE-2026-83461.md): Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). (CVSS 8.2, Oracle Mobile Application Server) - [CVE-2026-83460](https://cve.now/CVE-2026-83460.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA). (CVSS 6.5, Oracle Helidon) - [CVE-2026-83459](https://cve.now/CVE-2026-83459.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-media-multipart). (CVSS 5.3, Oracle Helidon) - [CVE-2026-83458](https://cve.now/CVE-2026-83458.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: JSON). (CVSS 5.3, Oracle Helidon) - [CVE-2026-83457](https://cve.now/CVE-2026-83457.md): Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Demand Signal Repository) - [CVE-2026-83456](https://cve.now/CVE-2026-83456.md): Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Demand Signal Repository) - [CVE-2026-83455](https://cve.now/CVE-2026-83455.md): Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Demand Signal Repository) - [CVE-2026-83454](https://cve.now/CVE-2026-83454.md): Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Document Management and Collaboration) - [CVE-2026-83453](https://cve.now/CVE-2026-83453.md): Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Document Management and Collaboration) - [CVE-2026-83452](https://cve.now/CVE-2026-83452.md): Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Internal Operations). (CVSS 9.8, Oracle Document Management and Collaboration) - [CVE-2026-83451](https://cve.now/CVE-2026-83451.md): Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.5, Oracle Product Workbench) - [CVE-2026-83450](https://cve.now/CVE-2026-83450.md): Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Setup Workbench). (CVSS 8.0, Oracle Bills of Material) - [CVE-2026-83449](https://cve.now/CVE-2026-83449.md): Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.5, Oracle Bills of Material) - [CVE-2026-83448](https://cve.now/CVE-2026-83448.md): Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Bills of Material) - [CVE-2026-89027](https://cve.now/CVE-2026-89027.md): miniOrange JWT Authentication for WP REST APIs \< 4.8.0 Authentication Downgrade (CVSS 6.9, miniOrange JWT Authentication for WP REST APIs) - [CVE-2026-83447](https://cve.now/CVE-2026-83447.md): Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Bills of Material) - [CVE-2026-83446](https://cve.now/CVE-2026-83446.md): Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components). (CVSS 8.1, Oracle Financials Common Modules) - [CVE-2026-83445](https://cve.now/CVE-2026-83445.md): Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Complex Maintenance, Repair and Overhaul) - [CVE-2026-83444](https://cve.now/CVE-2026-83444.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Product Hub) - [CVE-2026-83443](https://cve.now/CVE-2026-83443.md): Vulnerability in the Oracle Assets product of Oracle E-Business Suite (component: Internal Operations). (CVSS 6.5, Oracle Assets) - [CVE-2026-83442](https://cve.now/CVE-2026-83442.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Product Hub) - [CVE-2026-83441](https://cve.now/CVE-2026-83441.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 6.8, Oracle Product Hub) - [CVE-2026-83440](https://cve.now/CVE-2026-83440.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Product Hub) - [CVE-2026-83439](https://cve.now/CVE-2026-83439.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-idcs-mapper). (CVSS 8.1, Oracle Helidon) - [CVE-2026-83438](https://cve.now/CVE-2026-83438.md): Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.2, Oracle Engineering) - [CVE-2026-83437](https://cve.now/CVE-2026-83437.md): Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). (CVSS 7.7, Oracle Engineering) - [CVE-2026-83436](https://cve.now/CVE-2026-83436.md): Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Recall Management). (CVSS 7.1, Oracle Depot Repair) - [CVE-2026-83435](https://cve.now/CVE-2026-83435.md): Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.2, Oracle Bills of Material) - [CVE-2026-83434](https://cve.now/CVE-2026-83434.md): Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Product Workbench) - [CVE-2026-83433](https://cve.now/CVE-2026-83433.md): Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Depot Repair Diagnostics). (CVSS 6.5, Oracle Depot Repair) - [CVE-2026-83432](https://cve.now/CVE-2026-83432.md): Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Estimate and Actual Charges). (CVSS 8.1, Oracle Depot Repair) - [CVE-2026-83431](https://cve.now/CVE-2026-83431.md): Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). (CVSS 5.4, Oracle Product Workbench) - [CVE-2026-83430](https://cve.now/CVE-2026-83430.md): Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Product Workbench) - [CVE-2026-83429](https://cve.now/CVE-2026-83429.md): Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Demand Signal Repository) - [CVE-2026-83428](https://cve.now/CVE-2026-83428.md): Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Demand Signal Repository) - [CVE-2026-83425](https://cve.now/CVE-2026-83425.md): Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.5, Oracle Complex Maintenance, Repair and Overhaul) - [CVE-2026-83424](https://cve.now/CVE-2026-83424.md): Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). (CVSS 7.5, Oracle JDeveloper) - [CVE-2026-83423](https://cve.now/CVE-2026-83423.md): Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework). (CVSS 8.8, Oracle JDeveloper) - [CVE-2026-83422](https://cve.now/CVE-2026-83422.md): Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). (CVSS 8.1, Oracle Identity Manager) - [CVE-2026-83420](https://cve.now/CVE-2026-83420.md): Vulnerability in the PeopleSoft Enterprise FIN Engineering Brazil product of Oracle PeopleSoft (component: Engineering). (CVSS 7.8, Oracle PeopleSoft Enterprise FIN Engineering Brazil) - [CVE-2026-83419](https://cve.now/CVE-2026-83419.md): Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component… (CVSS 5.4, Oracle Communications Cloud Native Core Security Edge Prote…) - [CVE-2026-83418](https://cve.now/CVE-2026-83418.md): Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component… (CVSS 8.2, Oracle Communications Cloud Native Core Security Edge Prote…) - [CVE-2026-83417](https://cve.now/CVE-2026-83417.md): Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component… (CVSS 7.1, Oracle Communications Cloud Native Core Security Edge Prote…) - [CVE-2026-83416](https://cve.now/CVE-2026-83416.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 4.3, Oracle Coherence) - [CVE-2026-83415](https://cve.now/CVE-2026-83415.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle Coherence) - [CVE-2026-83414](https://cve.now/CVE-2026-83414.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 2.5, Oracle Coherence) - [CVE-2026-83413](https://cve.now/CVE-2026-83413.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 1.9, Oracle Coherence) - [CVE-2026-83412](https://cve.now/CVE-2026-83412.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 8.1, Oracle Coherence) - [CVE-2026-83411](https://cve.now/CVE-2026-83411.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 8.8, Oracle Coherence) - [CVE-2026-83410](https://cve.now/CVE-2026-83410.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 8.8, Oracle Coherence) - [CVE-2026-83369](https://cve.now/CVE-2026-83369.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Access SDK). (CVSS 3.1, Oracle Access Manager) - [CVE-2026-83356](https://cve.now/CVE-2026-83356.md): Vulnerability in the Enterprise Command Center Framework product of Oracle E-Business Suite (component: Security). (CVSS 7.7, Oracle Enterprise Command Center Framework) - [CVE-2026-83355](https://cve.now/CVE-2026-83355.md): Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: Metrics). (CVSS 9.8, Oracle Enterprise Manager for Fusion Middleware) - [CVE-2026-83354](https://cve.now/CVE-2026-83354.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 6.3, Oracle Coherence) - [CVE-2026-83353](https://cve.now/CVE-2026-83353.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 7.8, Oracle WebCenter Content) - [CVE-2026-83352](https://cve.now/CVE-2026-83352.md): Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). (CVSS 7.1, Oracle XML Gateway) - [CVE-2026-83351](https://cve.now/CVE-2026-83351.md): Vulnerability in the RDBMS component of Oracle Database Server. (CVSS 8.1, Oracle Database Server) - [CVE-2026-83350](https://cve.now/CVE-2026-83350.md): Vulnerability in the Oracle Net Services component of Oracle Database Server. (CVSS 7.5, Oracle Database Server) - [CVE-2026-83349](https://cve.now/CVE-2026-83349.md): Vulnerability in the Oracle Net Services component of Oracle Database Server. (CVSS 7.5, Oracle Database Server) - [CVE-2026-83348](https://cve.now/CVE-2026-83348.md): Vulnerability in the RDBMS component of Oracle Database Server. (CVSS 8.8, Oracle Database Server) - [CVE-2026-83347](https://cve.now/CVE-2026-83347.md): Vulnerability in the Oracle Net Services component of Oracle Database Server. (CVSS 6.5, Oracle Database Server) - [CVE-2026-83346](https://cve.now/CVE-2026-83346.md): Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware (component: Framework). (CVSS 5.4, Oracle Fusion Middleware Control) - [CVE-2026-83345](https://cve.now/CVE-2026-83345.md): Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). (CVSS 7.1, Oracle XML Gateway) - [CVE-2026-83344](https://cve.now/CVE-2026-83344.md): Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Database Application Table). (CVSS 7.2, Oracle Identity Manager Connector) - [CVE-2026-83343](https://cve.now/CVE-2026-83343.md): Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide). (CVSS 8.2, Oracle Utilities Network Management System) - [CVE-2026-83342](https://cve.now/CVE-2026-83342.md): Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide). (CVSS 7.8, Oracle Utilities Network Management System) - [CVE-2026-83341](https://cve.now/CVE-2026-83341.md): Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). (CVSS 7.5, Oracle Applications Manager) - [CVE-2026-83340](https://cve.now/CVE-2026-83340.md): Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Security). (CVSS 8.8, Oracle Identity Manager) - [CVE-2026-83339](https://cve.now/CVE-2026-83339.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 9.8, Oracle WebCenter Enterprise Capture) - [CVE-2026-83338](https://cve.now/CVE-2026-83338.md): Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). (CVSS 8.8, Oracle Applications Manager) - [CVE-2026-83337](https://cve.now/CVE-2026-83337.md): Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Remote Diagnostic Agent). (CVSS 7.8, Oracle Middleware Common Libraries and Tools) - [CVE-2026-83336](https://cve.now/CVE-2026-83336.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). (CVSS 7.8, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83335](https://cve.now/CVE-2026-83335.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). (CVSS 8.8, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83334](https://cve.now/CVE-2026-83334.md): Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). (CVSS 7.4, Oracle Web Services Manager) - [CVE-2026-83333](https://cve.now/CVE-2026-83333.md): Vulnerability in the Oracle Net Services component of Oracle Database Server. (CVSS 7.5, Oracle Database Server) - [CVE-2026-83332](https://cve.now/CVE-2026-83332.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). (CVSS 7.1, Oracle Applications Framework) - [CVE-2026-83331](https://cve.now/CVE-2026-83331.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). (CVSS 8.8, Oracle Applications Framework) - [CVE-2026-83330](https://cve.now/CVE-2026-83330.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket). (CVSS 7.5, Oracle Helidon) - [CVE-2026-83329](https://cve.now/CVE-2026-83329.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). (CVSS 8.8, Oracle Applications Framework) - [CVE-2026-83328](https://cve.now/CVE-2026-83328.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). (CVSS 7.2, Oracle Applications Framework) - [CVE-2026-83327](https://cve.now/CVE-2026-83327.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). (CVSS 9.8, Oracle Applications Framework) - [CVE-2026-83326](https://cve.now/CVE-2026-83326.md): Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). (CVSS 7.5, Oracle Siebel CRM Integration) - [CVE-2026-83325](https://cve.now/CVE-2026-83325.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.2, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83324](https://cve.now/CVE-2026-83324.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). (CVSS 7.1, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83323](https://cve.now/CVE-2026-83323.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.5, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83322](https://cve.now/CVE-2026-83322.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.2, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83321](https://cve.now/CVE-2026-83321.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Actions). (CVSS 8.5, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83320](https://cve.now/CVE-2026-83320.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Administration). (CVSS 7.6, Oracle BI Publisher) - [CVE-2026-89040](https://cve.now/CVE-2026-89040.md): Tencent Mass Service Engine in Cluster (MSEC) path traversal (CVSS 9.8, Tencent Mass Service Engine in Cluster) - [CVE-2026-83319](https://cve.now/CVE-2026-83319.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). (CVSS 7.7, Oracle BI Publisher) - [CVE-2026-83318](https://cve.now/CVE-2026-83318.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Administration). (CVSS 7.5, Oracle BI Publisher) - [CVE-2026-83317](https://cve.now/CVE-2026-83317.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Installation). (CVSS 7.8, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83316](https://cve.now/CVE-2026-83316.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.0, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83315](https://cve.now/CVE-2026-83315.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.8, Oracle BI Publisher) - [CVE-2026-83314](https://cve.now/CVE-2026-83314.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). (CVSS 8.1, Oracle BI Publisher) - [CVE-2026-83313](https://cve.now/CVE-2026-83313.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 7.7, Oracle BI Publisher) - [CVE-2026-83312](https://cve.now/CVE-2026-83312.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: E-Business Suite - XDO). (CVSS 7.7, Oracle BI Publisher) - [CVE-2026-83311](https://cve.now/CVE-2026-83311.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.5, Oracle BI Publisher) - [CVE-2026-83310](https://cve.now/CVE-2026-83310.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.7, Oracle BI Publisher) - [CVE-2026-83309](https://cve.now/CVE-2026-83309.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). (CVSS 8.5, Oracle BI Publisher) - [CVE-2026-83308](https://cve.now/CVE-2026-83308.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.1, Oracle BI Publisher) - [CVE-2026-83307](https://cve.now/CVE-2026-83307.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.3, Oracle BI Publisher) - [CVE-2026-83306](https://cve.now/CVE-2026-83306.md): Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Resource Catalog Services). (CVSS 8.8, Oracle JDeveloper) - [CVE-2026-83305](https://cve.now/CVE-2026-83305.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.6, Oracle BI Publisher) - [CVE-2026-83304](https://cve.now/CVE-2026-83304.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). (CVSS 8.9, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83303](https://cve.now/CVE-2026-83303.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.5, Oracle BI Publisher) - [CVE-2026-83302](https://cve.now/CVE-2026-83302.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security). (CVSS 8.5, Oracle BI Publisher) - [CVE-2026-83301](https://cve.now/CVE-2026-83301.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Service Administration UI). (CVSS 8.8, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83300](https://cve.now/CVE-2026-83300.md): Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). (CVSS 7.1, Oracle XML Gateway) - [CVE-2026-83299](https://cve.now/CVE-2026-83299.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). (CVSS 8.1, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83298](https://cve.now/CVE-2026-83298.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 7.2, Oracle BI Publisher) - [CVE-2026-83297](https://cve.now/CVE-2026-83297.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.1, Oracle BI Publisher) - [CVE-2026-83296](https://cve.now/CVE-2026-83296.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). (CVSS 7.5, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83295](https://cve.now/CVE-2026-83295.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). (CVSS 7.5, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83294](https://cve.now/CVE-2026-83294.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.8, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83293](https://cve.now/CVE-2026-83293.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: FNDN). (CVSS 7.8, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83292](https://cve.now/CVE-2026-83292.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.5, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83291](https://cve.now/CVE-2026-83291.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.8, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83290](https://cve.now/CVE-2026-83290.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.8, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83289](https://cve.now/CVE-2026-83289.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). (CVSS 7.5, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83288](https://cve.now/CVE-2026-83288.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). (CVSS 7.8, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83287](https://cve.now/CVE-2026-83287.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). (CVSS 7.7, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83286](https://cve.now/CVE-2026-83286.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 8.1, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83285](https://cve.now/CVE-2026-83285.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). (CVSS 8.3, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83284](https://cve.now/CVE-2026-83284.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.6, Oracle BI Publisher) - [CVE-2026-83283](https://cve.now/CVE-2026-83283.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 9.8, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83282](https://cve.now/CVE-2026-83282.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 9.9, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83281](https://cve.now/CVE-2026-83281.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver). (CVSS 7.5, Oracle Helidon) - [CVE-2026-83280](https://cve.now/CVE-2026-83280.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-http2). (CVSS 7.5, Oracle Helidon) - [CVE-2026-83279](https://cve.now/CVE-2026-83279.md): Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). (CVSS 5.5, Oracle Agile PLM MCAD Connector) - [CVE-2026-83278](https://cve.now/CVE-2026-83278.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-integrations-neo4j). (CVSS 6.8, Oracle Helidon) - [CVE-2026-83277](https://cve.now/CVE-2026-83277.md): Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). (CVSS 7.3, Oracle Agile PLM MCAD Connector) - [CVE-2026-83276](https://cve.now/CVE-2026-83276.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2). (CVSS 7.5, Oracle Helidon) - [CVE-2026-83274](https://cve.now/CVE-2026-83274.md): Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). (CVSS 5.5, Oracle Agile PLM MCAD Connector) - [CVE-2026-76796](https://cve.now/CVE-2026-76796.md): Newell Brands DYMO Connect Desktop improper file path validation (CVSS 4.0, Newell Brands DYMO Connect Desktop) - [CVE-2026-83273](https://cve.now/CVE-2026-83273.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.2, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83272](https://cve.now/CVE-2026-83272.md): Vulnerability in the Oracle Text component of Oracle Database Server. (CVSS 8.5, Oracle Database Server) - [CVE-2026-83271](https://cve.now/CVE-2026-83271.md): Vulnerability in the RDBMS component of Oracle Database Server. (CVSS 8.8, Oracle Database Server) - [CVE-2026-83270](https://cve.now/CVE-2026-83270.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). (CVSS 7.5, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83269](https://cve.now/CVE-2026-83269.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 9.8, Oracle BI Publisher) - [CVE-2026-83268](https://cve.now/CVE-2026-83268.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 9.1, Oracle BI Publisher) - [CVE-2026-83267](https://cve.now/CVE-2026-83267.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security). (CVSS 8.5, Oracle BI Publisher) - [CVE-2026-83266](https://cve.now/CVE-2026-83266.md): Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Resource Catalog Services). (CVSS 8.2, Oracle JDeveloper) - [CVE-2026-83265](https://cve.now/CVE-2026-83265.md): Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Agent). (CVSS 8.2, Oracle Web Services Manager) - [CVE-2026-83264](https://cve.now/CVE-2026-83264.md): Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). (CVSS 8.4, Oracle Product Lifecycle Analytics) - [CVE-2026-83263](https://cve.now/CVE-2026-83263.md): Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). (CVSS 7.5, Oracle Product Lifecycle Analytics) - [CVE-2026-83262](https://cve.now/CVE-2026-83262.md): Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). (CVSS 7.5, Oracle Product Lifecycle Analytics) - [CVE-2026-83261](https://cve.now/CVE-2026-83261.md): Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Core). (CVSS 9.8, Oracle Product Lifecycle Analytics) - [CVE-2026-83260](https://cve.now/CVE-2026-83260.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Event Java PX). (CVSS 9.1, Oracle Agile PLM) - [CVE-2026-83259](https://cve.now/CVE-2026-83259.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.1, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83258](https://cve.now/CVE-2026-83258.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 8.1, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83257](https://cve.now/CVE-2026-83257.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.5, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83256](https://cve.now/CVE-2026-83256.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 8.1, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83255](https://cve.now/CVE-2026-83255.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 8.1, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83254](https://cve.now/CVE-2026-83254.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 8.1, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83253](https://cve.now/CVE-2026-83253.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca… (CVSS 7.8, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83252](https://cve.now/CVE-2026-83252.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.0, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83251](https://cve.now/CVE-2026-83251.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 6.5, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83250](https://cve.now/CVE-2026-83250.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 6.5, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83249](https://cve.now/CVE-2026-83249.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.8, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83248](https://cve.now/CVE-2026-83248.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 8.2, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83247](https://cve.now/CVE-2026-83247.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.8, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83246](https://cve.now/CVE-2026-83246.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 8.1, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83245](https://cve.now/CVE-2026-83245.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 8.1, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83244](https://cve.now/CVE-2026-83244.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.1, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83243](https://cve.now/CVE-2026-83243.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience… (CVSS 7.7, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83242](https://cve.now/CVE-2026-83242.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience… (CVSS 7.3, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83241](https://cve.now/CVE-2026-83241.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.5, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83240](https://cve.now/CVE-2026-83240.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.1, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83239](https://cve.now/CVE-2026-83239.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca… (CVSS 7.0, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83238](https://cve.now/CVE-2026-83238.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.1, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83237](https://cve.now/CVE-2026-83237.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.1, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83236](https://cve.now/CVE-2026-83236.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience… (CVSS 8.2, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83235](https://cve.now/CVE-2026-83235.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience… (CVSS 7.5, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83234](https://cve.now/CVE-2026-83234.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience… (CVSS 8.2, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83233](https://cve.now/CVE-2026-83233.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience… (CVSS 7.7, Oracle Commerce Guided Search / Oracle Commerce Experience…) - [CVE-2026-83232](https://cve.now/CVE-2026-83232.md): Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). (CVSS 9.8, Oracle Data Integrator) - [CVE-2026-83231](https://cve.now/CVE-2026-83231.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-dbclient-mongodb). (CVSS 7.0, Oracle Helidon) - [CVE-2026-83230](https://cve.now/CVE-2026-83230.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel Management Console). (CVSS 7.1, Oracle Siebel CRM Deployment) - [CVE-2026-83229](https://cve.now/CVE-2026-83229.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel Management Console). (CVSS 9.1, Oracle Siebel CRM Deployment) - [CVE-2026-83228](https://cve.now/CVE-2026-83228.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.5, Oracle Siebel CRM Deployment) - [CVE-2026-83227](https://cve.now/CVE-2026-83227.md): Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). (CVSS 7.5, Oracle Siebel CRM Integration) - [CVE-2026-83226](https://cve.now/CVE-2026-83226.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.5, Oracle Siebel CRM Deployment) - [CVE-2026-83225](https://cve.now/CVE-2026-83225.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.5, Oracle Siebel CRM Deployment) - [CVE-2026-83224](https://cve.now/CVE-2026-83224.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.1, Oracle Siebel CRM Deployment) - [CVE-2026-83223](https://cve.now/CVE-2026-83223.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel Remote). (CVSS 7.5, Oracle Siebel CRM Deployment) - [CVE-2026-83222](https://cve.now/CVE-2026-83222.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.5, Oracle Siebel CRM Deployment) - [CVE-2026-83221](https://cve.now/CVE-2026-83221.md): Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). (CVSS 7.1, Oracle Siebel CRM Integration) - [CVE-2026-83220](https://cve.now/CVE-2026-83220.md): Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Event Publish and Subscribe). (CVSS 8.1, Oracle Siebel CRM Integration) - [CVE-2026-83219](https://cve.now/CVE-2026-83219.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.1, Oracle Siebel CRM Deployment) - [CVE-2026-83218](https://cve.now/CVE-2026-83218.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.4, Oracle Siebel CRM Deployment) - [CVE-2026-83217](https://cve.now/CVE-2026-83217.md): Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). (CVSS 7.1, Oracle Siebel CRM End User) - [CVE-2026-83216](https://cve.now/CVE-2026-83216.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.8, Oracle Siebel CRM Deployment) - [CVE-2026-83215](https://cve.now/CVE-2026-83215.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 8.2, Oracle Siebel CRM Deployment) - [CVE-2026-83214](https://cve.now/CVE-2026-83214.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.8, Oracle Siebel CRM Deployment) - [CVE-2026-83213](https://cve.now/CVE-2026-83213.md): Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Reports). (CVSS 7.5, Oracle Siebel CRM End User) - [CVE-2026-83212](https://cve.now/CVE-2026-83212.md): Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component: Helpdesk/Training). (CVSS 8.8, Oracle Siebel Apps - Self Service) - [CVE-2026-83211](https://cve.now/CVE-2026-83211.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.8, Oracle Siebel CRM Deployment) - [CVE-2026-83210](https://cve.now/CVE-2026-83210.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 8.8, Oracle Siebel CRM Deployment) - [CVE-2026-83209](https://cve.now/CVE-2026-83209.md): Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workflow). (CVSS 8.8, Oracle Siebel CRM Development) - [CVE-2026-83208](https://cve.now/CVE-2026-83208.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Migration). (CVSS 8.8, Oracle Siebel CRM Deployment) - [CVE-2026-83207](https://cve.now/CVE-2026-83207.md): Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Integration - Scripting). (CVSS 7.6, Oracle Siebel CRM Development) - [CVE-2026-83206](https://cve.now/CVE-2026-83206.md): Vulnerability in the Oracle Banking Corporate Lending Process Management product of Oracle Financial Services Applications (component… (CVSS 7.1, Oracle Banking Corporate Lending Process Management) - [CVE-2026-83205](https://cve.now/CVE-2026-83205.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). (CVSS 8.8, Oracle Applications Framework) - [CVE-2026-83204](https://cve.now/CVE-2026-83204.md): Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.5, Oracle Sourcing) - [CVE-2026-83203](https://cve.now/CVE-2026-83203.md): Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). (CVSS 8.6, Oracle Siebel CRM End User) - [CVE-2026-83202](https://cve.now/CVE-2026-83202.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 9.1, Oracle Siebel CRM Deployment) - [CVE-2026-83201](https://cve.now/CVE-2026-83201.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 9.1, Oracle Siebel CRM Deployment) - [CVE-2026-83200](https://cve.now/CVE-2026-83200.md): Vulnerability in the Oracle Process Manufacturing Intelligence product of Oracle E-Business Suite (component: Internal Operations). (CVSS 6.5, Oracle Process Manufacturing Intelligence) - [CVE-2026-83199](https://cve.now/CVE-2026-83199.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 8.8, Oracle Siebel CRM Deployment) - [CVE-2026-83198](https://cve.now/CVE-2026-83198.md): Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). (CVSS 5.4, Oracle Field Service) - [CVE-2026-83197](https://cve.now/CVE-2026-83197.md): Vulnerability in the Siebel Apps - Financial Services product of Oracle Siebel CRM (component: Financial Accounts). (CVSS 9.1, Oracle Siebel Apps - Financial Services) - [CVE-2026-83196](https://cve.now/CVE-2026-83196.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 9.1, Oracle Siebel CRM Deployment) - [CVE-2026-83195](https://cve.now/CVE-2026-83195.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.2, Oracle Siebel CRM Deployment) - [CVE-2026-83194](https://cve.now/CVE-2026-83194.md): Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Depot Repair) - [CVE-2026-83193](https://cve.now/CVE-2026-83193.md): Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: Life Sciences). (CVSS 7.3, Oracle Siebel Apps - Life Sciences) - [CVE-2026-83192](https://cve.now/CVE-2026-83192.md): Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). (CVSS 8.1, Oracle Siebel CRM End User) - [CVE-2026-83191](https://cve.now/CVE-2026-83191.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 8.1, Oracle Siebel CRM Deployment) - [CVE-2026-83190](https://cve.now/CVE-2026-83190.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.3, Oracle Siebel CRM Deployment) - [CVE-2026-83189](https://cve.now/CVE-2026-83189.md): Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Proxy User Delegation). (CVSS 8.8, Oracle User Management) - [CVE-2026-83188](https://cve.now/CVE-2026-83188.md): Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Depot Repair) - [CVE-2026-83187](https://cve.now/CVE-2026-83187.md): Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Applications Calendar). (CVSS 7.1, Oracle Common Applications Calendar) - [CVE-2026-83186](https://cve.now/CVE-2026-83186.md): Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Applications Calendar). (CVSS 7.1, Oracle Common Applications Calendar) - [CVE-2026-83185](https://cve.now/CVE-2026-83185.md): Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). (CVSS 7.3, Oracle Common Applications) - [CVE-2026-83184](https://cve.now/CVE-2026-83184.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). (CVSS 7.4, Oracle Application Object Library) - [CVE-2026-83183](https://cve.now/CVE-2026-83183.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.5, Oracle Siebel CRM Deployment) - [CVE-2026-83182](https://cve.now/CVE-2026-83182.md): Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Configuration Tools). (CVSS 7.5, Oracle Siebel CRM Development) - [CVE-2026-83181](https://cve.now/CVE-2026-83181.md): Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workspaces). (CVSS 8.2, Oracle Siebel CRM Development) - [CVE-2026-83180](https://cve.now/CVE-2026-83180.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 8.8, Oracle Siebel CRM Deployment) - [CVE-2026-83179](https://cve.now/CVE-2026-83179.md): Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Applications Calendar). (CVSS 7.1, Oracle Common Applications Calendar) - [CVE-2026-83178](https://cve.now/CVE-2026-83178.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). (CVSS 8.0, Oracle Application Object Library) - [CVE-2026-83177](https://cve.now/CVE-2026-83177.md): Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). (CVSS 8.1, Oracle One-to-One Fulfillment) - [CVE-2026-83176](https://cve.now/CVE-2026-83176.md): Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). (CVSS 7.2, Oracle Common Applications) - [CVE-2026-83175](https://cve.now/CVE-2026-83175.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). (CVSS 6.5, Oracle Application Object Library) - [CVE-2026-83174](https://cve.now/CVE-2026-83174.md): Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Application Framework). (CVSS 8.1, Oracle CRM Technical Foundation) - [CVE-2026-83173](https://cve.now/CVE-2026-83173.md): Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). (CVSS 7.1, Oracle One-to-One Fulfillment) - [CVE-2026-83172](https://cve.now/CVE-2026-83172.md): Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: OSO Other). (CVSS 8.5, Oracle Sales Online) - [CVE-2026-83171](https://cve.now/CVE-2026-83171.md): Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). (CVSS 7.1, Oracle One-to-One Fulfillment) - [CVE-2026-83170](https://cve.now/CVE-2026-83170.md): Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). (CVSS 8.0, Oracle One-to-One Fulfillment) - [CVE-2026-83169](https://cve.now/CVE-2026-83169.md): Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues). (CVSS 8.1, Oracle One-to-One Fulfillment) - [CVE-2026-83168](https://cve.now/CVE-2026-83168.md): Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). (CVSS 8.8, Oracle Applications Manager) - [CVE-2026-83167](https://cve.now/CVE-2026-83167.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). (CVSS 7.5, Oracle Application Object Library) - [CVE-2026-83166](https://cve.now/CVE-2026-83166.md): Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). (CVSS 7.7, Oracle Customer Interaction History) - [CVE-2026-83165](https://cve.now/CVE-2026-83165.md): Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: User Interface). (CVSS 8.8, Oracle Customer Interaction History) - [CVE-2026-83164](https://cve.now/CVE-2026-83164.md): Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). (CVSS 8.8, Oracle Customer Interaction History) - [CVE-2026-83163](https://cve.now/CVE-2026-83163.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Attachments / File Upload). (CVSS 8.8, Oracle Application Object Library) - [CVE-2026-83162](https://cve.now/CVE-2026-83162.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). (CVSS 7.4, Oracle Application Object Library) - [CVE-2026-83161](https://cve.now/CVE-2026-83161.md): Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle Project Intelligence) - [CVE-2026-83160](https://cve.now/CVE-2026-83160.md): Vulnerability in the RDBMS component of Oracle Database Server. (CVSS 8.8, Oracle Database Server) - [CVE-2026-83159](https://cve.now/CVE-2026-83159.md): Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: ADPatch). (CVSS 7.8, Oracle Applications DBA) - [CVE-2026-83158](https://cve.now/CVE-2026-83158.md): Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). (CVSS 7.1, Oracle Applications Manager) - [CVE-2026-83157](https://cve.now/CVE-2026-83157.md): Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). (CVSS 8.0, Oracle Applications Manager) - [CVE-2026-83156](https://cve.now/CVE-2026-83156.md): Vulnerability in the Oracle XML Developers Kit component of Oracle Database Server. (CVSS 7.5, Oracle Database Server) - [CVE-2026-83155](https://cve.now/CVE-2026-83155.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.3, Oracle Siebel CRM Deployment) - [CVE-2026-83154](https://cve.now/CVE-2026-83154.md): Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). (CVSS 9.1, Oracle Siebel CRM End User) - [CVE-2026-83153](https://cve.now/CVE-2026-83153.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 8.8, Oracle Siebel CRM Deployment) - [CVE-2026-83152](https://cve.now/CVE-2026-83152.md): Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Project Intelligence) - [CVE-2026-83151](https://cve.now/CVE-2026-83151.md): Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). (CVSS 9.8, Oracle Service Delivery Platform) - [CVE-2026-83150](https://cve.now/CVE-2026-83150.md): Vulnerability in Oracle Application Testing Suite. (CVSS 7.0, Oracle Application Testing Suite) - [CVE-2026-83149](https://cve.now/CVE-2026-83149.md): Vulnerability in Oracle Application Testing Suite. (CVSS 9.1, Oracle Application Testing Suite) - [CVE-2026-83148](https://cve.now/CVE-2026-83148.md): Vulnerability in Oracle Application Testing Suite. (CVSS 8.8, Oracle Application Testing Suite) - [CVE-2026-83147](https://cve.now/CVE-2026-83147.md): Vulnerability in the PeopleSoft Enterprise FIN Inventory Brazil product of Oracle PeopleSoft (component: Inventory). (CVSS 7.8, Oracle PeopleSoft Enterprise FIN Inventory Brazil) - [CVE-2026-83146](https://cve.now/CVE-2026-83146.md): Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). (CVSS 7.7, Oracle Siebel CRM End User) - [CVE-2026-83145](https://cve.now/CVE-2026-83145.md): Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM (component: Order Management). (CVSS 8.7, Oracle Siebel Apps - Customer Order Management) - [CVE-2026-83144](https://cve.now/CVE-2026-83144.md): Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM (component: Order Management). (CVSS 8.7, Oracle Siebel Apps - Customer Order Management) - [CVE-2026-83143](https://cve.now/CVE-2026-83143.md): Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing). (CVSS 8.1, Oracle Siebel Apps - Life Sciences) - [CVE-2026-83142](https://cve.now/CVE-2026-83142.md): Vulnerability in the Oracle Proposals product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.7, Oracle Proposals) - [CVE-2026-83141](https://cve.now/CVE-2026-83141.md): Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.7, Oracle Field Service) - [CVE-2026-83140](https://cve.now/CVE-2026-83140.md): Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). (CVSS 6.5, Oracle Field Service) - [CVE-2026-83138](https://cve.now/CVE-2026-83138.md): Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.0, Oracle Spares Management) - [CVE-2026-83137](https://cve.now/CVE-2026-83137.md): Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Spares Management) - [CVE-2026-83136](https://cve.now/CVE-2026-83136.md): Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Spares Management) - [CVE-2026-83135](https://cve.now/CVE-2026-83135.md): Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). (CVSS 8.7, Oracle iStore) - [CVE-2026-83134](https://cve.now/CVE-2026-83134.md): Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). (CVSS 7.7, Oracle iStore) - [CVE-2026-83133](https://cve.now/CVE-2026-83133.md): Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). (CVSS 7.5, Oracle iStore) - [CVE-2026-83132](https://cve.now/CVE-2026-83132.md): Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). (CVSS 8.1, Oracle iStore) - [CVE-2026-83131](https://cve.now/CVE-2026-83131.md): Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File download). (CVSS 7.7, Oracle Web Applications Desktop Integrator) - [CVE-2026-83130](https://cve.now/CVE-2026-83130.md): Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle Site Hub) - [CVE-2026-83129](https://cve.now/CVE-2026-83129.md): Vulnerability in the Oracle Sales product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.7, Oracle Sales) - [CVE-2026-83128](https://cve.now/CVE-2026-83128.md): Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.5, Oracle Sales Offline) - [CVE-2026-83127](https://cve.now/CVE-2026-83127.md): Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.7, Oracle Sales Offline) - [CVE-2026-83126](https://cve.now/CVE-2026-83126.md): Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.6, Oracle Sales Online) - [CVE-2026-83125](https://cve.now/CVE-2026-83125.md): Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Report Manager) - [CVE-2026-83124](https://cve.now/CVE-2026-83124.md): Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Sales Online) - [CVE-2026-83123](https://cve.now/CVE-2026-83123.md): Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle Report Manager) - [CVE-2026-83122](https://cve.now/CVE-2026-83122.md): Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Report Manager) - [CVE-2026-83121](https://cve.now/CVE-2026-83121.md): Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). (CVSS 8.8, Oracle Marketing) - [CVE-2026-83120](https://cve.now/CVE-2026-83120.md): Vulnerability in the Oracle Alert product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Alert) - [CVE-2026-83119](https://cve.now/CVE-2026-83119.md): Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle User Management) - [CVE-2026-83118](https://cve.now/CVE-2026-83118.md): Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). (CVSS 7.8, Oracle Applications DBA) - [CVE-2026-83117](https://cve.now/CVE-2026-83117.md): Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). (CVSS 7.2, Oracle Applications DBA) - [CVE-2026-83116](https://cve.now/CVE-2026-83116.md): Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). (CVSS 7.7, Oracle Order Management) - [CVE-2026-83115](https://cve.now/CVE-2026-83115.md): Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). (CVSS 7.5, Oracle Applications Manager) - [CVE-2026-83114](https://cve.now/CVE-2026-83114.md): Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.5, Oracle Quality) - [CVE-2026-83113](https://cve.now/CVE-2026-83113.md): Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle Quality) - [CVE-2026-83112](https://cve.now/CVE-2026-83112.md): Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Lease and Finance Management) - [CVE-2026-83111](https://cve.now/CVE-2026-83111.md): Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle Partner Management) - [CVE-2026-83110](https://cve.now/CVE-2026-83110.md): Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). (CVSS 7.5, Oracle Marketing) - [CVE-2026-83109](https://cve.now/CVE-2026-83109.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 5.3, Oracle Forms) - [CVE-2026-83108](https://cve.now/CVE-2026-83108.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.8, Oracle Forms) - [CVE-2026-83107](https://cve.now/CVE-2026-83107.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.1, Oracle Forms) - [CVE-2026-83106](https://cve.now/CVE-2026-83106.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 7.5, Oracle Forms) - [CVE-2026-83105](https://cve.now/CVE-2026-83105.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.0, Oracle Forms) - [CVE-2026-83104](https://cve.now/CVE-2026-83104.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.1, Oracle Forms) - [CVE-2026-83103](https://cve.now/CVE-2026-83103.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.1, Oracle Forms) - [CVE-2026-83102](https://cve.now/CVE-2026-83102.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 7.4, Oracle Forms) - [CVE-2026-83101](https://cve.now/CVE-2026-83101.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 8.1, Oracle Forms) - [CVE-2026-83100](https://cve.now/CVE-2026-83100.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.8, Oracle Forms) - [CVE-2026-83099](https://cve.now/CVE-2026-83099.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 10.0, Oracle Forms) - [CVE-2026-83098](https://cve.now/CVE-2026-83098.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.8, Oracle Forms) - [CVE-2026-83097](https://cve.now/CVE-2026-83097.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 6.5, Oracle Forms) - [CVE-2026-83096](https://cve.now/CVE-2026-83096.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 7.9, Oracle Forms) - [CVE-2026-83095](https://cve.now/CVE-2026-83095.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.8, Oracle Forms) - [CVE-2026-83094](https://cve.now/CVE-2026-83094.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.8, Oracle Forms) - [CVE-2026-83093](https://cve.now/CVE-2026-83093.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 8.6, Oracle Forms) - [CVE-2026-83092](https://cve.now/CVE-2026-83092.md): Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle Field Service) - [CVE-2026-83091](https://cve.now/CVE-2026-83091.md): Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.6, Oracle Field Service) - [CVE-2026-83090](https://cve.now/CVE-2026-83090.md): Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Spares Management) - [CVE-2026-83089](https://cve.now/CVE-2026-83089.md): Vulnerability in the Oracle Alert product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Alert) - [CVE-2026-83088](https://cve.now/CVE-2026-83088.md): Vulnerability in the RDBMS component of Oracle Database Server. (CVSS 7.7, Oracle Database Server) - [CVE-2026-83087](https://cve.now/CVE-2026-83087.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 8.2, Oracle Siebel CRM Cloud Applications) - [CVE-2026-83086](https://cve.now/CVE-2026-83086.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 8.8, Oracle Siebel CRM Cloud Applications) - [CVE-2026-83085](https://cve.now/CVE-2026-83085.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 8.2, Oracle Siebel CRM Cloud Applications) - [CVE-2026-83084](https://cve.now/CVE-2026-83084.md): Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). (CVSS 7.7, Oracle Marketing) - [CVE-2026-83083](https://cve.now/CVE-2026-83083.md): Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). (CVSS 8.5, Oracle Marketing) - [CVE-2026-83082](https://cve.now/CVE-2026-83082.md): Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). (CVSS 7.2, Oracle Marketing) - [CVE-2026-83081](https://cve.now/CVE-2026-83081.md): Vulnerability in the Oracle Banking Corporate Lending product of Oracle Financial Services Applications (component: Core). (CVSS 8.0, Oracle Banking Corporate Lending) - [CVE-2026-83080](https://cve.now/CVE-2026-83080.md): Vulnerability in the Oracle Banking Branch product of Oracle Financial Services Applications (component: Reports). (CVSS 7.1, Oracle Banking Branch) - [CVE-2026-83079](https://cve.now/CVE-2026-83079.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 7.9, Oracle Siebel CRM Cloud Applications) - [CVE-2026-83078](https://cve.now/CVE-2026-83078.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 8.2, Oracle Siebel CRM Cloud Applications) - [CVE-2026-83077](https://cve.now/CVE-2026-83077.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 6.4, Oracle Siebel CRM Cloud Applications) - [CVE-2026-83076](https://cve.now/CVE-2026-83076.md): Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). (CVSS 6.8, Oracle HR Intelligence) - [CVE-2026-83075](https://cve.now/CVE-2026-83075.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 7.5, Oracle Siebel CRM Cloud Applications) - [CVE-2026-83074](https://cve.now/CVE-2026-83074.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 8.6, Oracle Siebel CRM Cloud Applications) - [CVE-2026-83073](https://cve.now/CVE-2026-83073.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 8.1, Oracle Siebel CRM Cloud Applications) - [CVE-2026-83072](https://cve.now/CVE-2026-83072.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Search Bean \[Incl. (CVSS 8.1, Oracle Applications Framework) - [CVE-2026-83071](https://cve.now/CVE-2026-83071.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Machine Learning). (CVSS 7.8, Oracle Business Intelligence Enterprise Edition) - [CVE-2026-83070](https://cve.now/CVE-2026-83070.md): Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub product of Oracle PeopleSoft (component: Enterprise Portal). (CVSS 7.7, Oracle PeopleSoft Enterprise PRTL Interaction Hub) - [CVE-2026-83069](https://cve.now/CVE-2026-83069.md): Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware (component: Framework). (CVSS 8.8, Oracle Fusion Middleware Control) - [CVE-2026-83068](https://cve.now/CVE-2026-83068.md): Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Core). (CVSS 7.7, Oracle Enterprise Manager for Oracle Database) - [CVE-2026-83067](https://cve.now/CVE-2026-83067.md): Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Shared Components). (CVSS 8.1, Oracle JDeveloper) - [CVE-2026-83066](https://cve.now/CVE-2026-83066.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.8, Oracle Internet Directory) - [CVE-2026-83065](https://cve.now/CVE-2026-83065.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 7.5, Oracle WebCenter Portal) - [CVE-2026-83064](https://cve.now/CVE-2026-83064.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 9.1, Oracle WebCenter Portal) - [CVE-2026-83063](https://cve.now/CVE-2026-83063.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 7.2, Oracle Internet Directory) - [CVE-2026-83062](https://cve.now/CVE-2026-83062.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.8, Oracle Internet Directory) - [CVE-2026-83061](https://cve.now/CVE-2026-83061.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.8, Oracle Internet Directory) - [CVE-2026-83060](https://cve.now/CVE-2026-83060.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.8, Oracle Internet Directory) - [CVE-2026-83059](https://cve.now/CVE-2026-83059.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 10.0, Oracle Internet Directory) - [CVE-2026-83058](https://cve.now/CVE-2026-83058.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.9, Oracle Internet Directory) - [CVE-2026-83057](https://cve.now/CVE-2026-83057.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.9, Oracle Internet Directory) - [CVE-2026-83056](https://cve.now/CVE-2026-83056.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.9, Oracle Internet Directory) - [CVE-2026-83055](https://cve.now/CVE-2026-83055.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.9, Oracle Internet Directory) - [CVE-2026-83054](https://cve.now/CVE-2026-83054.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.8, Oracle Internet Directory) - [CVE-2026-83053](https://cve.now/CVE-2026-83053.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 8.8, Oracle WebCenter Portal) - [CVE-2026-83052](https://cve.now/CVE-2026-83052.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 7.6, Oracle WebCenter Portal) - [CVE-2026-83051](https://cve.now/CVE-2026-83051.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 7.5, Oracle WebCenter Portal) - [CVE-2026-83050](https://cve.now/CVE-2026-83050.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 7.1, Oracle WebCenter Portal) - [CVE-2026-83049](https://cve.now/CVE-2026-83049.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). (CVSS 8.5, Oracle WebCenter Portal) - [CVE-2026-83048](https://cve.now/CVE-2026-83048.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 7.7, Oracle WebCenter Portal) - [CVE-2026-83047](https://cve.now/CVE-2026-83047.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 8.2, Oracle WebCenter Portal) - [CVE-2026-83046](https://cve.now/CVE-2026-83046.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 7.1, Oracle WebCenter Portal) - [CVE-2026-83045](https://cve.now/CVE-2026-83045.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 8.5, Oracle WebCenter Portal) - [CVE-2026-83044](https://cve.now/CVE-2026-83044.md): Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). (CVSS 7.1, Oracle XML Gateway) - [CVE-2026-83043](https://cve.now/CVE-2026-83043.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). (CVSS 9.6, Oracle WebCenter Portal) - [CVE-2026-83042](https://cve.now/CVE-2026-83042.md): Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). (CVSS 9.8, Oracle Identity Manager) - [CVE-2026-83041](https://cve.now/CVE-2026-83041.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). (CVSS 7.7, Oracle WebCenter Portal) - [CVE-2026-83040](https://cve.now/CVE-2026-83040.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). (CVSS 9.6, Oracle WebCenter Portal) - [CVE-2026-83039](https://cve.now/CVE-2026-83039.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). (CVSS 9.9, Oracle WebCenter Portal) - [CVE-2026-83038](https://cve.now/CVE-2026-83038.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: TopLink Integration). (CVSS 9.9, Oracle WebLogic Server) - [CVE-2026-83037](https://cve.now/CVE-2026-83037.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 9.8, Oracle WebCenter Sites) - [CVE-2026-83036](https://cve.now/CVE-2026-83036.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 9.8, Oracle WebCenter Sites) - [CVE-2026-83035](https://cve.now/CVE-2026-83035.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 9.8, Oracle WebCenter Sites) - [CVE-2026-83034](https://cve.now/CVE-2026-83034.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 7.5, Oracle WebCenter Sites) - [CVE-2026-83033](https://cve.now/CVE-2026-83033.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 8.8, Oracle WebCenter Sites) - [CVE-2026-83032](https://cve.now/CVE-2026-83032.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 8.8, Oracle WebCenter Sites) - [CVE-2026-83031](https://cve.now/CVE-2026-83031.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 9.9, Oracle WebCenter Sites) - [CVE-2026-83030](https://cve.now/CVE-2026-83030.md): Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). (CVSS 8.3, Oracle Managed File Transfer) - [CVE-2026-83029](https://cve.now/CVE-2026-83029.md): Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). (CVSS 9.6, Oracle Managed File Transfer) - [CVE-2026-83028](https://cve.now/CVE-2026-83028.md): Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle Identity Manager Connector) - [CVE-2026-83027](https://cve.now/CVE-2026-83027.md): Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). (CVSS 9.3, Oracle Identity Manager Connector) - [CVE-2026-83026](https://cve.now/CVE-2026-83026.md): Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). (CVSS 8.3, Oracle Identity Manager Connector) - [CVE-2026-83025](https://cve.now/CVE-2026-83025.md): Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). (CVSS 8.7, Oracle Identity Manager Connector) - [CVE-2026-83024](https://cve.now/CVE-2026-83024.md): Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). (CVSS 7.8, Oracle Identity Manager Connector) - [CVE-2026-83023](https://cve.now/CVE-2026-83023.md): Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). (CVSS 8.6, Oracle Identity Manager Connector) - [CVE-2026-83022](https://cve.now/CVE-2026-83022.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 7.9, Oracle WebCenter Enterprise Capture) - [CVE-2026-83021](https://cve.now/CVE-2026-83021.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). (CVSS 10.0, Oracle WebLogic Server) - [CVE-2026-83020](https://cve.now/CVE-2026-83020.md): Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). (CVSS 10.0, Oracle Platform Security for Java) - [CVE-2026-83019](https://cve.now/CVE-2026-83019.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). (CVSS 8.1, Oracle PeopleSoft Enterprise PeopleTools) - [CVE-2026-83018](https://cve.now/CVE-2026-83018.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). (CVSS 7.8, Oracle PeopleSoft Enterprise PeopleTools) - [CVE-2026-83017](https://cve.now/CVE-2026-83017.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). (CVSS 8.8, Oracle PeopleSoft Enterprise PeopleTools) - [CVE-2026-83016](https://cve.now/CVE-2026-83016.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). (CVSS 7.2, Oracle PeopleSoft Enterprise PeopleTools) - [CVE-2026-83015](https://cve.now/CVE-2026-83015.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Cube Manager). (CVSS 7.0, Oracle PeopleSoft Enterprise PeopleTools) - [CVE-2026-83014](https://cve.now/CVE-2026-83014.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Cube Manager). (CVSS 8.1, Oracle PeopleSoft Enterprise PeopleTools) - [CVE-2026-83013](https://cve.now/CVE-2026-83013.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 8.8, Oracle WebCenter Enterprise Capture) - [CVE-2026-83012](https://cve.now/CVE-2026-83012.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 7.7, Oracle WebCenter Enterprise Capture) - [CVE-2026-83011](https://cve.now/CVE-2026-83011.md): Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). (CVSS 8.1, Oracle Platform Security for Java) - [CVE-2026-83010](https://cve.now/CVE-2026-83010.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 8.1, Oracle WebCenter Enterprise Capture) - [CVE-2026-83009](https://cve.now/CVE-2026-83009.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 8.8, Oracle WebCenter Enterprise Capture) - [CVE-2026-83008](https://cve.now/CVE-2026-83008.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 8.8, Oracle WebCenter Enterprise Capture) - [CVE-2026-83007](https://cve.now/CVE-2026-83007.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 8.5, Oracle WebCenter Enterprise Capture) - [CVE-2026-83006](https://cve.now/CVE-2026-83006.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 9.1, Oracle WebCenter Enterprise Capture) - [CVE-2026-83005](https://cve.now/CVE-2026-83005.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 8.8, Oracle WebCenter Enterprise Capture) - [CVE-2026-83004](https://cve.now/CVE-2026-83004.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 7.2, Oracle WebCenter Enterprise Capture) - [CVE-2026-83003](https://cve.now/CVE-2026-83003.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 8.5, Oracle WebCenter Enterprise Capture) - [CVE-2026-83002](https://cve.now/CVE-2026-83002.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 8.5, Oracle Access Manager) - [CVE-2026-83001](https://cve.now/CVE-2026-83001.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.1, Oracle Access Manager) - [CVE-2026-83000](https://cve.now/CVE-2026-83000.md): Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). (CVSS 9.8, Oracle Service Delivery Platform) - [CVE-2026-82999](https://cve.now/CVE-2026-82999.md): Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). (CVSS 9.9, Oracle Service Delivery Platform) - [CVE-2026-82998](https://cve.now/CVE-2026-82998.md): Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). (CVSS 9.9, Oracle Service Delivery Platform) - [CVE-2026-82997](https://cve.now/CVE-2026-82997.md): Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). (CVSS 9.9, Oracle Service Delivery Platform) - [CVE-2026-82996](https://cve.now/CVE-2026-82996.md): Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). (CVSS 7.8, Oracle Platform Security for Java) - [CVE-2026-82995](https://cve.now/CVE-2026-82995.md): Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). (CVSS 9.8, Oracle Platform Security for Java) - [CVE-2026-82994](https://cve.now/CVE-2026-82994.md): Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). (CVSS 9.8, Oracle Platform Security for Java) - [CVE-2026-82993](https://cve.now/CVE-2026-82993.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). (CVSS 8.5, Oracle PeopleSoft Enterprise PeopleTools) - [CVE-2026-82992](https://cve.now/CVE-2026-82992.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Installation). (CVSS 7.8, Oracle Siebel CRM Deployment) - [CVE-2026-73966](https://cve.now/CVE-2026-73966.md): Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). (CVSS 7.2, Oracle Siebel Apps - Marketing) - [CVE-2026-73965](https://cve.now/CVE-2026-73965.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway). (CVSS 6.8, Oracle Siebel CRM Deployment) - [CVE-2026-73963](https://cve.now/CVE-2026-73963.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). (CVSS 9.8, Oracle WebCenter Portal) - [CVE-2026-73962](https://cve.now/CVE-2026-73962.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.6, Oracle Access Manager) - [CVE-2026-73961](https://cve.now/CVE-2026-73961.md): Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). (CVSS 9.8, Oracle JDeveloper) - [CVE-2026-73960](https://cve.now/CVE-2026-73960.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Ren Server). (CVSS 7.5, Oracle PeopleSoft Enterprise PeopleTools) - [CVE-2026-73959](https://cve.now/CVE-2026-73959.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). (CVSS 8.8, Oracle WebCenter Portal) - [CVE-2026-73958](https://cve.now/CVE-2026-73958.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 8.1, Oracle Access Manager) - [CVE-2026-73957](https://cve.now/CVE-2026-73957.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). (CVSS 9.3, Oracle WebCenter Portal) - [CVE-2026-73956](https://cve.now/CVE-2026-73956.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). (CVSS 9.8, Oracle WebCenter Portal) - [CVE-2026-73955](https://cve.now/CVE-2026-73955.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Charting). (CVSS 7.3, Oracle PeopleSoft Enterprise PeopleTools) - [CVE-2026-73954](https://cve.now/CVE-2026-73954.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). (CVSS 8.1, Oracle PeopleSoft Enterprise PeopleTools) - [CVE-2026-73953](https://cve.now/CVE-2026-73953.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). (CVSS 9.8, Oracle WebCenter Portal) - [CVE-2026-73952](https://cve.now/CVE-2026-73952.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). (CVSS 9.1, Oracle WebCenter Portal) - [CVE-2026-73951](https://cve.now/CVE-2026-73951.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). (CVSS 8.1, Oracle WebCenter Portal) - [CVE-2026-73950](https://cve.now/CVE-2026-73950.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.8, Oracle Access Manager) - [CVE-2026-73949](https://cve.now/CVE-2026-73949.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). (CVSS 8.8, Oracle WebCenter Portal) - [CVE-2026-73948](https://cve.now/CVE-2026-73948.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). (CVSS 9.9, Oracle WebCenter Portal) - [CVE-2026-73947](https://cve.now/CVE-2026-73947.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.8, Oracle Access Manager) - [CVE-2026-73946](https://cve.now/CVE-2026-73946.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.1, Oracle Access Manager) - [CVE-2026-73945](https://cve.now/CVE-2026-73945.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.9, Oracle Access Manager) - [CVE-2026-73944](https://cve.now/CVE-2026-73944.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.1, Oracle Access Manager) - [CVE-2026-73943](https://cve.now/CVE-2026-73943.md): Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). (CVSS 7.6, Oracle Identity Manager) - [CVE-2026-73942](https://cve.now/CVE-2026-73942.md): Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). (CVSS 8.8, Oracle Identity Manager) - [CVE-2026-73941](https://cve.now/CVE-2026-73941.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 8.6, Oracle Access Manager) - [CVE-2026-73940](https://cve.now/CVE-2026-73940.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.8, Oracle Access Manager) - [CVE-2026-73926](https://cve.now/CVE-2026-73926.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 8.7, Oracle Access Manager) - [CVE-2026-71163](https://cve.now/CVE-2026-71163.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.9, Oracle Access Manager) - [CVE-2026-71133](https://cve.now/CVE-2026-71133.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 10.0, Oracle Access Manager) - [CVE-2026-71047](https://cve.now/CVE-2026-71047.md): Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). (CVSS 8.8, Oracle Identity Manager) - [CVE-2026-70915](https://cve.now/CVE-2026-70915.md): Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). (CVSS 8.8, Oracle Identity Manager) - [CVE-2026-70913](https://cve.now/CVE-2026-70913.md): Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle Identity Manager) - [CVE-2026-70757](https://cve.now/CVE-2026-70757.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle WebLogic Server) - [CVE-2026-70756](https://cve.now/CVE-2026-70756.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle WebLogic Server) - [CVE-2026-70755](https://cve.now/CVE-2026-70755.md): Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File download). (CVSS 6.5, Oracle Web Applications Desktop Integrator) - [CVE-2026-70748](https://cve.now/CVE-2026-70748.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle WebLogic Server) - [CVE-2026-62597](https://cve.now/CVE-2026-62597.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). (CVSS 6.5, Oracle Enterprise Manager Base Platform) - [CVE-2026-87288](https://cve.now/CVE-2026-87288.md): Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). (CVSS 8.1, Oracle GraalVM) - [CVE-2026-87287](https://cve.now/CVE-2026-87287.md): Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). (CVSS 8.1, Oracle GraalVM) - [CVE-2026-87286](https://cve.now/CVE-2026-87286.md): Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). (CVSS 8.1, Oracle GraalVM) - [CVE-2026-18425](https://cve.now/CVE-2026-18425.md): IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap… (CVSS 2.1, Concrete CMS) - [CVE-2026-18424](https://cve.now/CVE-2026-18424.md): Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use… (CVSS 2.1, Concrete CMS) - [CVE-2026-32599](https://cve.now/CVE-2026-32599.md): Netmaker has a boolean‑based SQL Injection (CVSS 5.3, gravitl netmaker · github.com/gravitl/netmaker) - [CVE-2026-61544](https://cve.now/CVE-2026-61544.md): libp2p-quic: Remote panic via certificate expiry race during QUIC handshake (CVSS 8.2, rust-libp2p · libp2p-quic) - [CVE-2026-88922](https://cve.now/CVE-2026-88922.md): Go-getter vulnerable to a privilege escalation issue in its archive decompression handling (CVSS 6.7, HashiCorp Shared library) - [CVE-2026-92240](https://cve.now/CVE-2026-92240.md): Out-of-bounds read in IMAP response parser (CVSS 9.1, Mozilla Thunderbird) - [CVE-2026-92239](https://cve.now/CVE-2026-92239.md): Buffer overrun in IMAP (CVSS 8.1, Mozilla Thunderbird) - [CVE-2026-92238](https://cve.now/CVE-2026-92238.md): Ambiguous parsing of mail headers (CVSS 9.8, Mozilla Thunderbird) - [CVE-2026-76820](https://cve.now/CVE-2026-76820.md): OpenCTI: Synchronizer SSRF: stream fetch has no URL validation (CVSS 7.7, OpenCTI-Platform opencti) - [CVE-2026-76821](https://cve.now/CVE-2026-76821.md): OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper (CVSS 7.1, OpenCTI-Platform opencti) - [CVE-2026-88975](https://cve.now/CVE-2026-88975.md): Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS\_MAX\_FRAME\_SIZE (CVSS 7.5, http4s · org.http4s:http4s-ember-core\_2.13 +2) - [CVE-2026-73458](https://cve.now/CVE-2026-73458.md): On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially… (CVSS 8.2, Arista Networks EOS) - [CVE-2026-18423](https://cve.now/CVE-2026-18423.md): Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and… (CVSS 2.1, Concrete CMS) - [CVE-2026-69206](https://cve.now/CVE-2026-69206.md): Http4s: DigestAuth allows replay of captured requests (CVSS 5.9, http4s · org.http4s:http4s-ember-core\_2.12 +2) - [CVE-2026-18422](https://cve.now/CVE-2026-18422.md): Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation (CVSS 2.1, Concrete CMS) - [CVE-2026-69202](https://cve.now/CVE-2026-69202.md): Http4s Ember HTTP/2: unbounded inbound body buffering (CVSS 7.5, http4s · org.http4s:http4s-ember-core\_2.12 +2) - [CVE-2026-76707](https://cve.now/CVE-2026-76707.md): Unauthenticated Information Disclosure in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 4.3, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76706](https://cve.now/CVE-2026-76706.md): Unauthenticated Information Disclosure in EdgeConnect SD-WAN Orchestrator API allows exposure of sensitive data (CVSS 5.3, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76705](https://cve.now/CVE-2026-76705.md): Authenticated Buffer Overflow Vulnerability in an API Endpoint Leads to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 5.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76704](https://cve.now/CVE-2026-76704.md): Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in EdgeConnect SD-WAN Orchestrator Web-Based Management Interface (CVSS 5.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76703](https://cve.now/CVE-2026-76703.md): Authenticated Buffer Overflow Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways Web-Based Management Interface Causes… (CVSS 5.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76702](https://cve.now/CVE-2026-76702.md): Authenticated Local Denial-of-Service Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 5.8, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76701](https://cve.now/CVE-2026-76701.md): Unauthenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 5.9, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76700](https://cve.now/CVE-2026-76700.md): Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 5.9, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76699](https://cve.now/CVE-2026-76699.md): Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 6.4, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76698](https://cve.now/CVE-2026-76698.md): Authenticated Command Injection Vulnerability leads to Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 6.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76697](https://cve.now/CVE-2026-76697.md): Authenticated Information Disclosure in HPE Networking EdgeConnect Enterprise Web-Based Management Interface (CVSS 6.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76696](https://cve.now/CVE-2026-76696.md): Unauthenticated Denial-of-Service (DoS) Vulnerability leads to Service Disruption in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 6.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76695](https://cve.now/CVE-2026-76695.md): Unauthenticated Buffer Overflow Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 6.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76694](https://cve.now/CVE-2026-76694.md): Authenticated Privilege Escalation Vulnerability in the Command Line Interface of HPE Networking EdgeConnect SD-WAN Gateways (CVSS 6.6, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76693](https://cve.now/CVE-2026-76693.md): Unauthenticated Denial-of-Service Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 7.0, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76692](https://cve.now/CVE-2026-76692.md): Unauthenticated Adjacent Information Disclosure and Denial-of-Service Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 7.1, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76691](https://cve.now/CVE-2026-76691.md): Authenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateway API Endpoint (CVSS 7.2, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76690](https://cve.now/CVE-2026-76690.md): Authenticated Remote Code Execution Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 7.2, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76689](https://cve.now/CVE-2026-76689.md): Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN… (CVSS 7.2, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76688](https://cve.now/CVE-2026-76688.md): Authentication Bypass Vulnerabilities in the Web-Based Management Interface of EdgeConnect SD-WAN Orchestrator (CVSS 7.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76687](https://cve.now/CVE-2026-76687.md): Authenticated Arbitrary File Write Leading to Remote Code Execution in EdgeConnect SD-WAN Orchestrator (CVSS 7.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76686](https://cve.now/CVE-2026-76686.md): Unauthenticated Denial-of-Service (DoS) Vulnerability leads to Service Disruption in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 7.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76685](https://cve.now/CVE-2026-76685.md): Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN… (CVSS 8.1, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76684](https://cve.now/CVE-2026-76684.md): Authentication Bypass Vulnerabilities in HPE Networking EdgeConnect SD-WAN Orchestrator API (CVSS 8.1, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76683](https://cve.now/CVE-2026-76683.md): Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 8.1, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76682](https://cve.now/CVE-2026-76682.md): Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 8.2, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76681](https://cve.now/CVE-2026-76681.md): Authenticated Information Disclosure Vulnerability in HPE Networking EdgeConnect SD-WAN Orchestrator API (CVSS 8.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76680](https://cve.now/CVE-2026-76680.md): Authenticated Server-Side Request Forgery Vulnerabilities Leading to Information Disclosure in EdgeConnect SD-WAN Orchestrator (CVSS 8.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76679](https://cve.now/CVE-2026-76679.md): Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 8.6, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76678](https://cve.now/CVE-2026-76678.md): Authenticated Command Injection Vulnerability leads to Remote Code Execution in EdgeConnect SD-WAN Gateways (CVSS 8.8, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76677](https://cve.now/CVE-2026-76677.md): Authorization Bypass Leading to Privilege Escalation in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 8.8, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76676](https://cve.now/CVE-2026-76676.md): Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in EdgeConnect SD-WAN Gateways (CVSS 8.8, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76675](https://cve.now/CVE-2026-76675.md): Authenticated Command Injection Vulnerability Leads to Privilege Escalation in EdgeConnect SD-WAN Gateways (CVSS 9.1, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76674](https://cve.now/CVE-2026-76674.md): Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 9.8, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76673](https://cve.now/CVE-2026-76673.md): Authentication Bypass Vulnerabilities in API of EdgeConnect SD-WAN Orchestrator (CVSS 9.8, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76672](https://cve.now/CVE-2026-76672.md): Authenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Orchestrator (CVSS 9.9, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76670](https://cve.now/CVE-2026-76670.md): Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator (CVSS 9.9, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-76669](https://cve.now/CVE-2026-76669.md): Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator (CVSS 9.9, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways) - [CVE-2026-69218](https://cve.now/CVE-2026-69218.md): Http4s Ember HTTP/2: unbounded continuation frame accumulation (CVSS 7.5, http4s · org.http4s:http4s-ember-core\_2.12 +2) - [CVE-2026-69203](https://cve.now/CVE-2026-69203.md): Http4s Ember HTTP/2: does not enforce SETTINGS\_MAX\_CONCURRENT\_STREAMS (CVSS 7.5, http4s · org.http4s:http4s-ember-core\_2.12 +2) - [CVE-2026-69217](https://cve.now/CVE-2026-69217.md): Http4s: Ember Server accepts duplicate Content-Length headers (CVSS 8.7, http4s) - [CVE-2026-69210](https://cve.now/CVE-2026-69210.md): Http4s: WebSocket decoder accepts negative length, causing infinite decode loop (CVSS 7.5, http4s) - [CVE-2026-69215](https://cve.now/CVE-2026-69215.md): Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin (CVSS 6.8, http4s · org.http4s:http4s-client\_2.12 +2) - [CVE-2026-69205](https://cve.now/CVE-2026-69205.md): Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling) (CVSS 8.7, http4s · org.http4s:http4s-ember-core\_3 +2) - [CVE-2026-13327](https://cve.now/CVE-2026-13327.md): Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a… (CVSS 8.3, Devolutions Server) - [CVE-2026-84850](https://cve.now/CVE-2026-84850.md): Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16… (CVSS 4.8, Devolutions Server) - [CVE-2026-18421](https://cve.now/CVE-2026-18421.md): Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify… (CVSS 2.1, Concrete CMS) - [CVE-2026-69212](https://cve.now/CVE-2026-69212.md): Http4s: FollowRedirect middleware leaks credentials over https-\>http same-authority redirect (CVSS 5.9, http4s) - [CVE-2026-90969](https://cve.now/CVE-2026-90969.md): Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user… (CVSS 6.5, Devolutions Server) - [CVE-2026-68529](https://cve.now/CVE-2026-68529.md): Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a… (CVSS 2.1, Concrete CMS) - [CVE-2026-69213](https://cve.now/CVE-2026-69213.md): Http4s Ember HTTP/2: unbounded outbound frame queue (CVSS 7.5, http4s · org.http4s:http4s-ember-core\_2.12 +2) - [CVE-2026-84048](https://cve.now/CVE-2026-84048.md): Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery \< 4.4.2 (CVSS 6.3, joomgalleryfriends.net JoomGallery extension for Joomla) - [CVE-2026-90971](https://cve.now/CVE-2026-90971.md): Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a… (CVSS 6.5, Devolutions Server) - [CVE-2026-68530](https://cve.now/CVE-2026-68530.md): Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other… (CVSS 2.1, Concrete CMS) - [CVE-2026-69214](https://cve.now/CVE-2026-69214.md): Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain (CVSS 6.8, http4s · org.http4s:http4s-client\_2.12 +2) - [CVE-2026-68531](https://cve.now/CVE-2026-68531.md): Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword Search (CVSS 2.1, Concrete CMS) - [CVE-2026-69201](https://cve.now/CVE-2026-69201.md): Http4s: ResourceService and Webjar Service path escape via percent-encoded separators (CVSS 5.9, http4s · org.http4s:http4s-server\_2.12 +2) - [CVE-2026-69216](https://cve.now/CVE-2026-69216.md): Http4s: Ember chunk parser lenience (TE.TE request smuggling) (CVSS 5.4, http4s · org.http4s:http4s-ember-core\_2.12 +2) - [CVE-2026-69211](https://cve.now/CVE-2026-69211.md): Http4s: Set-Cookie rendering does not escape attribute delimiters (CVSS 4.8, http4s) - [CVE-2026-81924](https://cve.now/CVE-2026-81924.md): Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation (CVSS 2.1, Concrete CMS) - [CVE-2026-69209](https://cve.now/CVE-2026-69209.md): Http4s: WebSocket decoder accepts unbounded message sizes (CVSS 7.5, http4s) - [CVE-2026-82190](https://cve.now/CVE-2026-82190.md): Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 (CVSS 6.3, j2commerce.com J2Store extension for Joomla) - [CVE-2026-81923](https://cve.now/CVE-2026-81923.md): Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor (CVSS 2.1, Concrete CMS) - [CVE-2026-78081](https://cve.now/CVE-2026-78081.md): Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2… (CVSS 7.1, j2commerce.com J2Store extension for Joomla) - [CVE-2026-81922](https://cve.now/CVE-2026-81922.md): "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary… (CVSS 2.1, Concrete CMS) - [CVE-2026-81568](https://cve.now/CVE-2026-81568.md): Joomla Extension - j2commerce.com - Arbitrary file read via \`task=download\` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 (CVSS 8.7, j2commerce.com J2Store extension for Joomla) - [CVE-2026-82191](https://cve.now/CVE-2026-82191.md): Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22… (CVSS 5.3, j2commerce.com J2Store extension for Joomla) - [CVE-2026-69208](https://cve.now/CVE-2026-69208.md): Http4s: DigestAuth nonce map grows unbounded (CVSS 7.5, http4s · org.http4s:http4s-ember-server\_2.12 +2) - [CVE-2026-81567](https://cve.now/CVE-2026-81567.md): Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2… (CVSS 8.7, j2commerce.com J2Store extension for Joomla) - [CVE-2026-81921](https://cve.now/CVE-2026-81921.md): In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status (CVSS 2.3, Concrete CMS) - [CVE-2026-82189](https://cve.now/CVE-2026-82189.md): Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 (CVSS 8.7, j2commerce.com J2Store extension for Joomla) - [CVE-2026-81920](https://cve.now/CVE-2026-81920.md): Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint (CVSS 2.3, Concrete CMS) - [CVE-2026-73467](https://cve.now/CVE-2026-73467.md): On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller… (CVSS 6.3, Arista Networks EOS) - [CVE-2026-68532](https://cve.now/CVE-2026-68532.md): Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard Action (CVSS 2.3, Concrete CMS) - [CVE-2026-69204](https://cve.now/CVE-2026-69204.md): Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling) (CVSS 9.2, http4s · org.http4s:http4s-ember-core\_2.12 +2) - [CVE-2026-73466](https://cve.now/CVE-2026-73466.md): On affected platforms running Arista EOS, under certain circumstances plaintext user passwords (CVSS 6.3, Arista Networks EOS) - [CVE-2026-73465](https://cve.now/CVE-2026-73465.md): On affected platforms running Arista EOS, under certain circumstances plaintext private keys (CVSS 6.3, Arista Networks EOS) - [CVE-2026-58773](https://cve.now/CVE-2026-58773.md): In link\_load\_gnss\_image of link\_device.c, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 6.7, Google Android) - [CVE-2026-58767](https://cve.now/CVE-2026-58767.md): In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. (CVSS 6.7, Google Android) - [CVE-2026-58766](https://cve.now/CVE-2026-58766.md): In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. (CVSS 7.8, Google Android) - [CVE-2026-58765](https://cve.now/CVE-2026-58765.md): In GPU, there is a possible permission bypass due to a logic error in the code. (CVSS 6.7, Google Android) - [CVE-2026-58755](https://cve.now/CVE-2026-58755.md): In smmu\_install\_nested\_ste of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. (CVSS 6.7, Google Android) - [CVE-2026-58751](https://cve.now/CVE-2026-58751.md): In multiple functions of arm-smmu-v3.c, there is a possible use-after-free due to a logic error in the code. (CVSS 6.7, Google Android) - [CVE-2026-58747](https://cve.now/CVE-2026-58747.md): In smmu\_detach\_dev of arm-smmu-v3.c, there is a possible permission bypass due to a logic error in the code. (CVSS 6.7, Google Android) - [CVE-2026-58744](https://cve.now/CVE-2026-58744.md): In multiple locations, there is a possible escalation of privilege due to improper input validation. (CVSS 7.8, Google Android) - [CVE-2026-58739](https://cve.now/CVE-2026-58739.md): In platform\_msg\_handler\_init of default\_msg\_handlers.c, there is a possible confused deputy due to a confused deputy. (CVSS 6.7, Google Android) - [CVE-2026-58734](https://cve.now/CVE-2026-58734.md): In google\_mba\_recv\_msg of google\_mba\_poll.c, there is a possible out-of-bounds write due to a race condition. (CVSS 7.0, Google Android) - [CVE-2026-58731](https://cve.now/CVE-2026-58731.md): In multiple functions of physmem\_extmem\_linux.c, there is a possible out-of-bounds read due to uninitialized data. (CVSS 6.2, Google Android) - [CVE-2026-58728](https://cve.now/CVE-2026-58728.md): In ARM64\_TLBI of mmu.h, there is a possible memory corruption due to a race condition. (CVSS 7.0, Google Android) - [CVE-2026-58726](https://cve.now/CVE-2026-58726.md): In FsmReleaseKey of fsm.c, there is a possible permission bypass due to a missing permission check. (CVSS 6.7, Google Android) - [CVE-2026-58724](https://cve.now/CVE-2026-58724.md): In multiple locations, there is a possible use-after-free due to a race condition. (CVSS 7.0, Google Android) - [CVE-2026-58721](https://cve.now/CVE-2026-58721.md): In multiple locations, there is a possible information disclosure due to uninitialized memory use. (CVSS 4.4, Google Android) - [CVE-2026-58718](https://cve.now/CVE-2026-58718.md): In smmu\_detach\_dev\_nested of arm-smmu-v3.c, there is a possible escalation of privilege due to improper input validation. (CVSS 6.7, Google Android) - [CVE-2026-58716](https://cve.now/CVE-2026-58716.md): In multiple locations, there is a possible time-of-check to time-of-use due to a race condition. (CVSS 6.7, Google Android) - [CVE-2026-58710](https://cve.now/CVE-2026-58710.md): In DecodeFilmGrainParams of film\_grain\_dec.cc, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 8.8, Google Android) - [CVE-2026-58704](https://cve.now/CVE-2026-58704.md): In Cellular Modem, there is a possible permission bypass due to a logic error in the code. (CVSS 8.8, KEV, Google Android) - [CVE-2026-58701](https://cve.now/CVE-2026-58701.md): In trusty\_dputc of generic-arm64-smcall.c, there is a possible out-of-bounds write due to a race condition. (CVSS 7.0, Google Android) - [CVE-2026-58699](https://cve.now/CVE-2026-58699.md): In Vp9DecEndOfStream of vp9hwd\_output.cc, there is a possible out-of-bounds read due to an incorrect bounds check. (CVSS 8.4, Google Android) - [CVE-2026-58698](https://cve.now/CVE-2026-58698.md): In ap\_pmic\_poll\_msg\_handler of ap\_pmic\_ipc.c, there is a possible permission bypass due to a confused deputy. (CVSS 6.7, Google Android) - [CVE-2026-58695](https://cve.now/CVE-2026-58695.md): In gmc\_phy\_lp3\_exit\_restore\_registers of phy\_power.c, there is a possible escalation of privilege due to a missing bounds check. (CVSS 7.8, Google Android) - [CVE-2026-58691](https://cve.now/CVE-2026-58691.md): In FsmReleaseKey of fsm.c, there is a possible permission bypass due to improper input validation. (CVSS 8.4, Google Android) - [CVE-2026-58683](https://cve.now/CVE-2026-58683.md): In IP Multimedia Subsystem, there is a possible out-of-bounds write due to improper input validation. (CVSS 8.8, Google Android) - [CVE-2026-58679](https://cve.now/CVE-2026-58679.md): In gf\_ta\_test\_set\_config of gf\_ta\_test.c, there is a possible heap buffer overflow due to a logic error in the code. (CVSS 8.4, Google Android) - [CVE-2026-58678](https://cve.now/CVE-2026-58678.md): In Bootloader, there is a possible permission bypass due to a logic error in the code. (CVSS 7.8, Google Android) - [CVE-2026-57042](https://cve.now/CVE-2026-57042.md): In multiple functions of DreamPickerReceiver.kt, there is a possible permission bypass due to a confused deputy. (CVSS 6.7, Google Android) - [CVE-2026-57035](https://cve.now/CVE-2026-57035.md): In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 6.7, Google Android) - [CVE-2026-57014](https://cve.now/CVE-2026-57014.md): In phNxpNciHal\_ext\_process\_nfc\_init\_rsp of phNxpNciHal\_ext.cc, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 7.8, Google Android) - [CVE-2026-57012](https://cve.now/CVE-2026-57012.md): In the Setup Wizard, there is a possible remote package install due to a missing permission check. (CVSS 8.4, Google Android) - [CVE-2026-57008](https://cve.now/CVE-2026-57008.md): In Modem, there is a possible information disclosure due to improper input validation. (CVSS 7.5, Google Android) - [CVE-2026-57006](https://cve.now/CVE-2026-57006.md): In acfw\_ffa.c, there is a possible secret read due to a logic error in the code. (CVSS 4.4, Google Android) - [CVE-2026-56997](https://cve.now/CVE-2026-56997.md): In Av1DecodeFrameTag of vp9hwd\_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 8.8, Google Android) - [CVE-2026-56992](https://cve.now/CVE-2026-56992.md): In multiple files, there is a possible permission bypass due to a confused deputy. (CVSS 6.7, Google Android) - [CVE-2026-56989](https://cve.now/CVE-2026-56989.md): In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 6.7, Google Android) - [CVE-2026-56988](https://cve.now/CVE-2026-56988.md): In multiple functions of bluetooth\_cco.cc, there is a possible use-after-free due to a race condition. (CVSS 6.4, Google Android) - [CVE-2026-56986](https://cve.now/CVE-2026-56986.md): In multiple files, there is a possible out-of-bounds read due to type confusion. (CVSS 8.4, Google Android) - [CVE-2026-56985](https://cve.now/CVE-2026-56985.md): In multiple files, there is a possible way to obtain signatures due to type confusion. (CVSS 8.4, Google Android) - [CVE-2026-56982](https://cve.now/CVE-2026-56982.md): In VPU, there is a possible permission bypass due to a missing permission check. (CVSS 7.8, Google Android) - [CVE-2026-56979](https://cve.now/CVE-2026-56979.md): In multiple locations, there is a possible permission bypass due to a logic error in the code. (CVSS 6.7, Google Android) - [CVE-2026-56978](https://cve.now/CVE-2026-56978.md): In get\_global\_config\_item\_addr of gc.c, there is a possible out-of-bounds read due to a missing bounds check. (CVSS 8.4, Google Android) - [CVE-2026-56975](https://cve.now/CVE-2026-56975.md): In Cellular Modem, there is a possible denial of service due to improper input validation. (CVSS 6.5, Google Android) - [CVE-2026-56974](https://cve.now/CVE-2026-56974.md): In Start of AudioRtpPayloadEncoderNode.cpp, there is a possible out-of-bounds write due to improper input validation. (CVSS 8.8, Google Android) - [CVE-2026-56973](https://cve.now/CVE-2026-56973.md): In multiple locations, there is a possible escalation of privilege due to a logic error in the code. (CVSS 6.7, Google Android) - [CVE-2026-56972](https://cve.now/CVE-2026-56972.md): In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. (CVSS 6.7, Google Android) - [CVE-2026-56970](https://cve.now/CVE-2026-56970.md): In multiple locations, there is a possible permission bypass due to a missing permission check. (CVSS 8.4, Google Android) - [CVE-2026-56967](https://cve.now/CVE-2026-56967.md): In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow. (CVSS 8.0, Google Android) - [CVE-2026-56964](https://cve.now/CVE-2026-56964.md): In multiple locations, there is a possible use-after-free due to a race condition. (CVSS 6.4, Google Android) - [CVE-2026-56960](https://cve.now/CVE-2026-56960.md): In multiple locations, there is a possible use-after-free due to a logic error in the code. (CVSS 9.8, Google Android) - [CVE-2026-56958](https://cve.now/CVE-2026-56958.md): In gf\_algo\_get\_cached\_dump\_data of gf\_algo.c, there is a possible out-of-bounds read due to a missing bounds check. (CVSS 5.5, Google Android) - [CVE-2026-56950](https://cve.now/CVE-2026-56950.md): In validate\_ns\_buf of mbu\_class.rs, there is a possible information disclosure due to improper input validation. (CVSS 4.4, Google Android) - [CVE-2026-56945](https://cve.now/CVE-2026-56945.md): In VPU, there is a possible out-of-bounds write due to a confused deputy. (CVSS 7.8, Google Android) - [CVE-2026-56942](https://cve.now/CVE-2026-56942.md): In ReadTileInfo of vp9hwd\_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 8.8, Google Android) - [CVE-2026-56941](https://cve.now/CVE-2026-56941.md): In multiple functions of fpc\_tee\_hal.c, there is a possible use-after-free due to a logic error in the code. (CVSS 8.4, Google Android) - [CVE-2026-56932](https://cve.now/CVE-2026-56932.md): In Trusted Execution Environment, there is a possible memory corruption due to improper input validation. (CVSS 6.7, Google Android) - [CVE-2026-56923](https://cve.now/CVE-2026-56923.md): In handle\_unmap\_req of tipc\_virtio\_dev.c, there is a possible memory corruption due to a race condition. (CVSS 6.4, Google Android) - [CVE-2026-56922](https://cve.now/CVE-2026-56922.md): In CPM, there is a possible permission bypass due to a confused deputy. (CVSS 6.7, Google Android) - [CVE-2026-56920](https://cve.now/CVE-2026-56920.md): In s\_decode\_vui\_param of fw\_hevc\_dec\_header.c, there is a possible out-of-bounds write due to a logic error in the code. (CVSS 8.8, Google Android) - [CVE-2026-56915](https://cve.now/CVE-2026-56915.md): In bigo\_worker\_thread of bigo.c, there is a possible escalation of privilege due to a race condition. (CVSS 6.4, Google Android) - [CVE-2026-56914](https://cve.now/CVE-2026-56914.md): In multiple locations, there is a possible use-after-free due to improper locking. (CVSS 8.4, Google Android) - [CVE-2026-56907](https://cve.now/CVE-2026-56907.md): In VPU, there is a possible shared memory overwrite due to improper input validation. (CVSS 6.7, Google Android) - [CVE-2026-56892](https://cve.now/CVE-2026-56892.md): In ReadDataElement of common.c, there is a possible information disclosure due to an incorrect bounds check. (CVSS 6.2, Google Android) - [CVE-2026-56889](https://cve.now/CVE-2026-56889.md): In multiple locations, there is a possible permission bypass due to an integer overflow. (CVSS 6.7, Google Android) - [CVE-2026-56888](https://cve.now/CVE-2026-56888.md): In multiple locations, there is a possible permission bypass due to side channel information disclosure. (CVSS 6.2, Google Android) - [CVE-2026-56882](https://cve.now/CVE-2026-56882.md): In Cellular Modem, there is a possible information disclosure due to a logic error in the code. (CVSS 8.8, Google Android) - [CVE-2026-56881](https://cve.now/CVE-2026-56881.md): In enable\_segment of remap.c, there is a possible permission bypass due to a logic error in the code. (CVSS 8.4, Google Android) - [CVE-2026-56879](https://cve.now/CVE-2026-56879.md): In gmc\_mb\_msg\_handler of gmc\_mba.c, there is a possible memory corruption due to a confused deputy. (CVSS 6.7, Google Android) - [CVE-2026-55366](https://cve.now/CVE-2026-55366.md): In IP Multimedia Subsystem, there is a possible authentication bypass due to a logic error in the code. (CVSS 9.8, Google Android) - [CVE-2026-55365](https://cve.now/CVE-2026-55365.md): In multiple functions of remap.c, there is a possible out-of-bounds write due to an incorrect bounds check. (CVSS 6.7, Google Android) - [CVE-2026-55359](https://cve.now/CVE-2026-55359.md): In multiple locations, there is a possible permission bypass due to a logic error in the code. (CVSS 7.8, Google Android) - [CVE-2026-55351](https://cve.now/CVE-2026-55351.md): In VPU, there is a possible out-of-bounds write due to an integer overflow. (CVSS 7.8, Google Android) - [CVE-2026-55343](https://cve.now/CVE-2026-55343.md): In decodeAmr of ImsMediaAudioPlayer.cpp, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 8.0, Google Android) - [CVE-2026-55332](https://cve.now/CVE-2026-55332.md): In multiple locations, there is a possible out-of-bounds write due to improper input validation. (CVSS 6.7, Google Android) - [CVE-2026-55331](https://cve.now/CVE-2026-55331.md): In IP Multimedia Subsystem, there is a possible out-of-bounds write due to an incorrect bounds check. (CVSS 8.8, Google Android) - [CVE-2026-55323](https://cve.now/CVE-2026-55323.md): In gf\_base\_update\_finger\_base of gf\_base.c, there is a possible out-of-bounds write due to a heap buffer overflow. (CVSS 7.8, Google Android) - [CVE-2026-55318](https://cve.now/CVE-2026-55318.md): In multiple locations, there is a possible use-after-free due to a race condition. (CVSS 8.8, Google Android) - [CVE-2026-55317](https://cve.now/CVE-2026-55317.md): In printf of printf.c, there is a possible out-of-bounds write due to improper input validation. (CVSS 6.7, Google Android) - [CVE-2026-55306](https://cve.now/CVE-2026-55306.md): In Cellular Modem, there is a possible denial of service due to improper input validation. (CVSS 7.5, Google Android) - [CVE-2026-55304](https://cve.now/CVE-2026-55304.md): In addr\_remap\_address\_map of remap.c, there is a possible escalation of privilege due to a logic error in the code. (CVSS 6.7, Google Android) - [CVE-2026-55302](https://cve.now/CVE-2026-55302.md): In multiple locations, there is a possible permission bypass due to a logic error in the code. (CVSS 6.7, Google Android) - [CVE-2026-55301](https://cve.now/CVE-2026-55301.md): In Wave6VpuDecFlush of wave6.c, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 8.4, Google Android) - [CVE-2026-0200](https://cve.now/CVE-2026-0200.md): In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow. (CVSS 8.8, Google Android) - [CVE-2026-0199](https://cve.now/CVE-2026-0199.md): In gf\_ta\_test\_set\_config of gf\_ta\_test.c, there is a possible out-of-bounds write due to improper input validation. (CVSS 7.8, Google Android) - [CVE-2026-0197](https://cve.now/CVE-2026-0197.md): In VPU, there is a possible information dislclosure due to a logic error in the code. (CVSS 4.4, Google Android) - [CVE-2026-0194](https://cve.now/CVE-2026-0194.md): In multiple locations, there is a possible permission bypass due to an integer overflow. (CVSS 8.4, Google Android) - [CVE-2026-0192](https://cve.now/CVE-2026-0192.md): In Bootloader, there is a possible escalation of privilege due to a missing permission check. (CVSS 6.7, Google Android) - [CVE-2026-0189](https://cve.now/CVE-2026-0189.md): In ac\_init\_policy of init.c, there is a possible permission bypass due to a logic error in the code. (CVSS 8.4, Google Android) - [CVE-2026-0187](https://cve.now/CVE-2026-0187.md): In gsa\_sw\_pk\_hash\_compare of image-auth-srv.c, there is a possible escalation of privilege due to a logic error in the code. (CVSS 6.7, Google Android) - [CVE-2026-0186](https://cve.now/CVE-2026-0186.md): In ac\_init\_one\_sswrp of init.c, there is a possible escalation of privilege due to a logic error in the code. (CVSS 6.7, Google Android) - [CVE-2026-0183](https://cve.now/CVE-2026-0183.md): In CPM, there is a possible information disclosure due to a confused deputy. (CVSS 4.4, Google Android) - [CVE-2026-0179](https://cve.now/CVE-2026-0179.md): In Bootloader, there is a possible permission bypass due to a missing permission check. (CVSS 6.7, Google Android) - [CVE-2026-0177](https://cve.now/CVE-2026-0177.md): In do\_sss\_aes\_gcm\_256\_op of crypto-aes.c, there is a possible out-of-bounds read due to a missing bounds check. (CVSS 4.4, Google Android) - [CVE-2026-0171](https://cve.now/CVE-2026-0171.md): In multiple locations, there is a possible out-of-bounds write due to a logic error in the code. (CVSS 8.8, Google Android) - [CVE-2026-0170](https://cve.now/CVE-2026-0170.md): In Vp9DecodeFrameTag of vp9hwd\_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 8.8, Google Android) - [CVE-2026-0159](https://cve.now/CVE-2026-0159.md): In Cellular Modem, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 8.8, Google Android) - [CVE-2026-68533](https://cve.now/CVE-2026-68533.md): Missing Authorization in Concrete CMS versions below 9.5.3 Conversation File Upload Allows File Import Without the Add Message Attachments… (CVSS 2.3, Concrete CMS) - [CVE-2026-68534](https://cve.now/CVE-2026-68534.md): Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors (CVSS 2.3, Concrete CMS) - [CVE-2026-81919](https://cve.now/CVE-2026-81919.md): Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint (CVSS 2.3, Concrete CMS) - [CVE-2026-19641](https://cve.now/CVE-2026-19641.md): On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan… (CVSS 5.3, Arista Networks EOS) - [CVE-2026-73451](https://cve.now/CVE-2026-73451.md): On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces… (CVSS 4.8, Arista Networks EOS) - [CVE-2026-92176](https://cve.now/CVE-2026-92176.md): pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, pdfforge PDF Architect) - [CVE-2026-92177](https://cve.now/CVE-2026-92177.md): pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, pdfforge PDF Architect) - [CVE-2026-92178](https://cve.now/CVE-2026-92178.md): pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, pdfforge PDF Architect) - [CVE-2026-92179](https://cve.now/CVE-2026-92179.md): pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, pdfforge PDF Architect) - [CVE-2026-92180](https://cve.now/CVE-2026-92180.md): pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (CVSS 7.8, pdfforge PDF Architect) - [CVE-2026-19781](https://cve.now/CVE-2026-19781.md): Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt) - [CVE-2026-19886](https://cve.now/CVE-2026-19886.md): OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, OriginLab Origin Viewer) - [CVE-2026-19885](https://cve.now/CVE-2026-19885.md): OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, OriginLab Origin Viewer) - [CVE-2026-19774](https://cve.now/CVE-2026-19774.md): BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.1, BlueZ) - [CVE-2026-19773](https://cve.now/CVE-2026-19773.md): libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 9.8, libwebsockets) - [CVE-2026-19504](https://cve.now/CVE-2026-19504.md): Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability (CVSS 4.0, Fabric.js) - [CVE-2026-85234](https://cve.now/CVE-2026-85234.md): Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine (CVSS 7.5, Red Hat Enterprise Linux · Red Hat Hardened Images) - [CVE-2026-81899](https://cve.now/CVE-2026-81899.md): Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members \> Groups dashboard (CVSS 7.3, Concrete CMS) - [CVE-2026-57442](https://cve.now/CVE-2026-57442.md): MCPVault: PathFilter restricted directories (.git/.obsidian/node\_modules) only denied at vault root, not nested (CVSS 6.9, bitbonsai mcpvault · @bitbonsai/mcpvault) - [CVE-2026-57441](https://cve.now/CVE-2026-57441.md): MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence (CVSS 8.4, bitbonsai mcpvault · @bitbonsai/mcpvault) - [CVE-2026-58483](https://cve.now/CVE-2026-58483.md): mcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in \`web\_url\_read\` (CVSS 7.5, ihor-sokoliuk mcp-searxng · mcp-searxng) - [CVE-2026-40058](https://cve.now/CVE-2026-40058.md): Vulnerability Affecting Office Macro Removal in CrowdStrike Falcon Sensor for Windows (CVSS 8.8, CrowdStrike Falcon sensor for Windows · CrowdStrike Laroux…) - [CVE-2026-81237](https://cve.now/CVE-2026-81237.md): Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Improper Authentication vulnerability. (CVSS 6.5, Dell Wyse Management Suite) - [CVE-2026-58485](https://cve.now/CVE-2026-58485.md): mcp-searxng: DNS-resolved Private Hostname SSRF in \`web\_url\_read\` (CVSS 7.1, ihor-sokoliuk mcp-searxng · mcp-searxng) - [CVE-2026-54688](https://cve.now/CVE-2026-54688.md): mcp-searxng: SSRF in web\_url\_read: the internal-address guard is disabled by default (MCP\_HTTP\_HARDEN off) (CVSS 6.5, ihor-sokoliuk mcp-searxng · mcp-searxng) - [CVE-2026-81238](https://cve.now/CVE-2026-81238.md): Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Authentication for Critical Function vulnerability. (CVSS 7.5, Dell Wyse Management Suite) - [CVE-2026-54689](https://cve.now/CVE-2026-54689.md): mcp-searxng hardened-mode SSRF bypasses permit internal URL access (CVSS 6.3, ihor-sokoliuk mcp-searxng · mcp-searxng) - [CVE-2026-56830](https://cve.now/CVE-2026-56830.md): Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization (CVSS 6.5, shopperlabs shopper · shopper/framework) - [CVE-2026-81235](https://cve.now/CVE-2026-81235.md): Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Cryptographic Step vulnerability. (CVSS 8.0, Dell Wyse Management Suite) - [CVE-2026-11728](https://cve.now/CVE-2026-11728.md): IBM MQ .NET client is vulnerable to remote code execution (CVSS 8.1, IBM MQ) - [CVE-2026-56831](https://cve.now/CVE-2026-56831.md): Shopper: Negative discount values accepted and propagated through order calculation pipeline (CVSS 6.5, shopperlabs shopper · shopper/framework) - [CVE-2026-56827](https://cve.now/CVE-2026-56827.md): Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility… (CVSS 8.1, shopperlabs shopper · shopper/framework) - [CVE-2026-81240](https://cve.now/CVE-2026-81240.md): Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. (CVSS 8.6, Dell Wyse Management Suite) - [CVE-2026-56829](https://cve.now/CVE-2026-56829.md): Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component (CVSS 8.1, shopperlabs shopper · shopper/framework) - [CVE-2026-18115](https://cve.now/CVE-2026-18115.md): In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change\_password Enables Account Takeover. (CVSS 7.4, Concrete CMS) - [CVE-2026-56825](https://cve.now/CVE-2026-56825.md): Shopper: Missing authorization on product removal actions in CollectionProducts component (CVSS 8.1, shopperlabs shopper · shopper/framework) - [CVE-2026-58502](https://cve.now/CVE-2026-58502.md): githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow (CVSS 7.1, gouef githubtoplanguages) - [CVE-2026-81239](https://cve.now/CVE-2026-81239.md): Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. (CVSS 8.6, Dell Wyse Management Suite) - [CVE-2026-12910](https://cve.now/CVE-2026-12910.md): Missing Authentication for Critical Function in GitLab (CVSS 5.4, GitLab) - [CVE-2026-13210](https://cve.now/CVE-2026-13210.md): Incorrect Authorization in GitLab (CVSS 7.7, GitLab) - [CVE-2026-82837](https://cve.now/CVE-2026-82837.md): Insertion of Sensitive Information Into Sent Data in GitLab (CVSS 5.3, GitLab) - [CVE-2026-81236](https://cve.now/CVE-2026-81236.md): Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. (CVSS 8.6, Dell Wyse Management Suite) - [CVE-2026-55374](https://cve.now/CVE-2026-55374.md): canto-saas-api: Authenticated API requests can be redirected via unencoded path variables (CVSS 4.8, jleehr canto-saas-api · jleehr/canto-saas-api) - [CVE-2026-18113](https://cve.now/CVE-2026-18113.md): Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Names (CVSS 7.5, Concrete CMS) - [CVE-2026-11729](https://cve.now/CVE-2026-11729.md): IBM MQ Java messaging is vulnerable to remote code execution (CVSS 8.5, IBM MQ) - [CVE-2026-55375](https://cve.now/CVE-2026-55375.md): canto-saas-api: OAuth credentials exposed in URL query string and exception messages (CVSS 5.3, jleehr canto-saas-api · jleehr/canto-saas-api) - [CVE-2026-11864](https://cve.now/CVE-2026-11864.md): Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026. (CVSS 6.5, IBM Cloud Pak for Business Automation) - [CVE-2026-81898](https://cve.now/CVE-2026-81898.md): Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views (CVSS 7.5, Concrete CMS) - [CVE-2026-61668](https://cve.now/CVE-2026-61668.md): DIRAC: Pilot code downloaded over unverified HTTPS connection (CVSS 8.1, DIRACGrid DIRAC · dirac) - [CVE-2026-11918](https://cve.now/CVE-2026-11918.md): IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures (CVSS 5.4, IBM ContextForge MCP Gateway) - [CVE-2026-11921](https://cve.now/CVE-2026-11921.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 9.1, IBM Verify Identity Access · IBM Security Verify Access) - [CVE-2026-61667](https://cve.now/CVE-2026-61667.md): DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval (CVSS 9.9, DIRACGrid DIRAC · dirac) - [CVE-2026-53459](https://cve.now/CVE-2026-53459.md): Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints (CVSS 9.3, maziggy bambuddy) - [CVE-2026-45579](https://cve.now/CVE-2026-45579.md): DIRAC: RCE in RequestManager due to eval on untrusted input (CVSS 9.9, DIRACGrid DIRAC · dirac) - [CVE-2026-11926](https://cve.now/CVE-2026-11926.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 7.5, IBM Verify Identity Access · IBM Security Verify Access) - [CVE-2026-11927](https://cve.now/CVE-2026-11927.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 6.5, IBM Verify Identity Access · IBM Security Verify Access) - [CVE-2026-53954](https://cve.now/CVE-2026-53954.md): Bugsink: DOS using large numbers of event tags (CVSS 4.3, bugsink) - [CVE-2026-11928](https://cve.now/CVE-2026-11928.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 9.8, IBM Verify Identity Access · IBM Security Verify Access) - [CVE-2026-48785](https://cve.now/CVE-2026-48785.md): Apptainer: Incorrect path matching for 'limit container paths' directive (CVSS 4.8, apptainer · github.com/apptainer/apptainer) - [CVE-2026-11929](https://cve.now/CVE-2026-11929.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 7.5, IBM Verify Identity Access · IBM Security Verify Access) - [CVE-2026-54549](https://cve.now/CVE-2026-54549.md): Meta Ads MCP: Server-Side Request Forgery (SSRF) in \`upload\_ad\_image\` via Unrestricted \`image\_url\` Fetch (CVSS 8.3, pipeboard-co meta-ads-mcp · meta-ads-mcp) - [CVE-2026-54547](https://cve.now/CVE-2026-54547.md): Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token (CVSS 7.4, pipeboard-co meta-ads-mcp · meta-ads-mcp) - [CVE-2026-11934](https://cve.now/CVE-2026-11934.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 7.2, IBM Verify Identity Access · IBM Security Verify Access) - [CVE-2026-12101](https://cve.now/CVE-2026-12101.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 8.1, IBM Verify Identity Access · IBM Security Verify Access) - [CVE-2026-55225](https://cve.now/CVE-2026-55225.md): Strimzi: Cross-namespace privilege escalation via \`Kafka.spec.entityOperator\` (CVSS 8.0, strimzi-kafka-operator · io.strimzi:strimzi) - [CVE-2026-12150](https://cve.now/CVE-2026-12150.md): IBM MQ queue manager is vulnerable to denial of service (CVSS 7.0, IBM MQ) - [CVE-2026-12351](https://cve.now/CVE-2026-12351.md): IBM MQ is vulnerable to unauthenticated remote code execution via JNDI injection (CVSS 9.8, IBM MQ) - [CVE-2026-55226](https://cve.now/CVE-2026-55226.md): Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator (CVSS 5.4, strimzi-kafka-operator · io.strimzi:strimzi) - [CVE-2026-54251](https://cve.now/CVE-2026-54251.md): netty-incubator-codec-ohttp: \[OHttpServerCodec\] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service (CVSS 8.7, netty-incubator-codec-ohttp · io.netty.incubator netty-i… +1) - [CVE-2026-12354](https://cve.now/CVE-2026-12354.md): IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection (CVSS 7.5, IBM MQ) - [CVE-2026-12355](https://cve.now/CVE-2026-12355.md): IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution (CVSS 8.1, IBM MQ) - [CVE-2026-12358](https://cve.now/CVE-2026-12358.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 7.5, IBM Verify Identity Access · IBM Security Verify Access) - [CVE-2026-54050](https://cve.now/CVE-2026-54050.md): Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image (CVSS 6.5, sakaiproject sakai · org.sakaiproject.profile2:profile2-… +1) - [CVE-2026-44300](https://cve.now/CVE-2026-44300.md): OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection (CVSS 8.8, opencost · github.com/opencost/opencost) - [CVE-2026-12666](https://cve.now/CVE-2026-12666.md): IBM MQ Java messaging is vulnerable to XML external entity injection (CVSS 8.1, IBM MQ) - [CVE-2026-12667](https://cve.now/CVE-2026-12667.md): IBM MQ .NET client is vulnerable to XML external entity injection (CVSS 7.1, IBM MQ) - [CVE-2026-12728](https://cve.now/CVE-2026-12728.md): IBM MQ Java messaging is vulnerable to remote code execution (CVSS 8.8, IBM MQ) - [CVE-2026-12742](https://cve.now/CVE-2026-12742.md): Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026 (CVSS 5.4, IBM Business Automation Workflow containers and traditional) - [CVE-2026-88765](https://cve.now/CVE-2026-88765.md): Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab (CVSS 8.5, GitLab) - [CVE-2026-12749](https://cve.now/CVE-2026-12749.md): Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026. (CVSS 6.4, IBM Cloud Pak for Business Automation) - [CVE-2026-12750](https://cve.now/CVE-2026-12750.md): Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026. (CVSS 6.4, IBM Cloud Pak for Business Automation) - [CVE-2026-12751](https://cve.now/CVE-2026-12751.md): Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026. (CVSS 5.4, IBM Cloud Pak for Business Automation) - [CVE-2026-12752](https://cve.now/CVE-2026-12752.md): Multiple security vulnerabilities addressed with IBM Business Automation Workflow August 2026 (CVSS 7.1, IBM Business Automation Workflow containers and traditional) - [CVE-2026-53941](https://cve.now/CVE-2026-53941.md): Inspektor Gadget Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS (CVSS 6.9, inspektor-gadget · github.com/inspektor-gadget/inspektor-ga…) - [CVE-2026-44778](https://cve.now/CVE-2026-44778.md): Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF (CVSS 2.9, inspektor-gadget · github.com/inspektor-gadget/inspektor-ga…) - [CVE-2026-21588](https://cve.now/CVE-2026-21588.md): This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1… (CVSS 7.1, Atlassian Confluence Data Center) - [CVE-2026-21587](https://cve.now/CVE-2026-21587.md): This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. (CVSS 7.1, Atlassian Jira Service Management Data Center) - [CVE-2026-21586](https://cve.now/CVE-2026-21586.md): This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0… (CVSS 7.1, Atlassian Confluence Data Center) - [CVE-2026-58201](https://cve.now/CVE-2026-58201.md): Lokka: Azure Resource Manager URL path validation issue (CVSS 8.7, merill lokka · @merill/lokka) - [CVE-2026-53710](https://cve.now/CVE-2026-53710.md): MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python\_sandbox\_server (CVSS 10.0, IBM mcp-context-forge · mcp-contextforge-gateway) - [CVE-2026-81897](https://cve.now/CVE-2026-81897.md): Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save\_control (CVSS 7.7, Concrete CMS) - [CVE-2026-55863](https://cve.now/CVE-2026-55863.md): motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution (CVSS 5.3, motioneye-project motioneye · motioneye) - [CVE-2026-46488](https://cve.now/CVE-2026-46488.md): motionEye: Authentication possible via password hash (CVSS 9.1, motioneye-project motioneye · motioneye) - [CVE-2026-91855](https://cve.now/CVE-2026-91855.md): Open5GS PFCP Message handler.c denial of service (CVSS 6.9, Open5GS) - [CVE-2026-81896](https://cve.now/CVE-2026-81896.md): Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label (CVSS 8.4, Concrete CMS) - [CVE-2026-63443](https://cve.now/CVE-2026-63443.md): Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write (CVSS 8.3, coder · github.com/coder/coder/v2 +1) - [CVE-2024-58385](https://cve.now/CVE-2024-58385.md): Yonyou U8 CRM SQL Injection via fillbacksettingedit.php (CVSS 9.3, Yonyou U8 CRM) - [CVE-2023-54398](https://cve.now/CVE-2023-54398.md): Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet (CVSS 9.3, Yonyou U8 Cloud) - [CVE-2026-18111](https://cve.now/CVE-2026-18111.md): Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity… (CVSS 8.5, Concrete CMS) - [CVE-2026-89026](https://cve.now/CVE-2026-89026.md): Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate (CVSS 9.3, Issabel Foundation Issabel Framework) - [CVE-2026-81895](https://cve.now/CVE-2026-81895.md): Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via \`fsID\[\]\` in \`setMode=any\` (CVSS 8.5, Concrete CMS) - [CVE-2026-54503](https://cve.now/CVE-2026-54503.md): plone.app.textfield: Stored XSS by spoofing mime type (CVSS 4.3, plone.app.textfield · plone-app-textfield) - [CVE-2026-53658](https://cve.now/CVE-2026-53658.md): Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter (CVSS 6.3, hyperledger fabric-ca · github.com/hyperledger/fabric-ca) - [CVE-2026-59160](https://cve.now/CVE-2026-59160.md): Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/run (CVSS 8.8, DerYeger yeger · @yeger/turbo-graph) - [CVE-2026-81894](https://cve.now/CVE-2026-81894.md): Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption field (CVSS 8.5, Concrete CMS) - [CVE-2026-55691](https://cve.now/CVE-2026-55691.md): EmbedVideo Extension : Stored XSS via unsanitized class passed to template (CVSS 8.6, StarCitizenWiki mediawiki-extensions-EmbedVideo · starcitiz…) - [CVE-2026-55690](https://cve.now/CVE-2026-55690.md): EmbedVideo Extension: Stored XSS via unsanitized service name in exception text (CVSS 7.5, StarCitizenWiki mediawiki-extensions-EmbedVideo · starcitiz…) - [CVE-2026-18110](https://cve.now/CVE-2026-18110.md): Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint… (CVSS 8.7, Concrete CMS) - [CVE-2026-55692](https://cve.now/CVE-2026-55692.md): EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled (CVSS 7.5, StarCitizenWiki mediawiki-extensions-EmbedVideo · starcitiz…) - [CVE-2026-54561](https://cve.now/CVE-2026-54561.md): MCP Memory Keeper: Arbitrary local file read in mcp-memory-keeper context\_import via unvalidated filePath (CVSS 6.2, mkreyman mcp-memory-keeper · mcp-memory-keeper) - [CVE-2026-55149](https://cve.now/CVE-2026-55149.md): Vouch Proxy: Unbounded Multipart Cookie Allocation DoS (CVSS 7.5, vouch-proxy · github.com/vouch/vouch-proxy) - [CVE-2026-91854](https://cve.now/CVE-2026-91854.md): code-projects Record Management System reg.php cross site scripting (CVSS 5.3, code-projects Record Management System) - [CVE-2026-58200](https://cve.now/CVE-2026-58200.md): @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing (CVSS 7.1, jhb-software payload-plugins · @jhb.software/payload-cloudi…) - [CVE-2026-79699](https://cve.now/CVE-2026-79699.md): Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory (CVSS 4.4, Red Hat Ansible Automation Platform · Red Hat Enterprise… +5) - [CVE-2026-79705](https://cve.now/CVE-2026-79705.md): Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers (CVSS 4.5, Red Hat Hardened Images · Red Hat Ansible Automation Pla… +5) - [CVE-2026-91853](https://cve.now/CVE-2026-91853.md): TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection (CVSS 5.3, TOTOLINK X5000R) - [CVE-2026-89022](https://cve.now/CVE-2026-89022.md): BookStack \< 26.05.5 Authentication Bypass via Social Login Provider Confusion (CVSS 9.1, bookstackapp bookstack) - [CVE-2026-19780](https://cve.now/CVE-2026-19780.md): Koha Eval Code Injection Remote Code Execution Vulnerability (CVSS 8.8, Koha) - [CVE-2026-59965](https://cve.now/CVE-2026-59965.md): @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API \`overrideAccess\` Omission (CVSS 7.1, jhb-software payload-plugins · @jhb.software payload-alt… +1) - [CVE-2026-58196](https://cve.now/CVE-2026-58196.md): ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) (CVSS 4.7, stacklok toolhive · github.com/stacklok/toolhive) - [CVE-2026-54450](https://cve.now/CVE-2026-54450.md): ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway (CVSS 2.9, stacklok toolhive · github.com/stacklok/toolhive) - [CVE-2026-59157](https://cve.now/CVE-2026-59157.md): webhookd: Unrestricted HTTP Header to Shell Variable Injection (CVSS 6.5, ncarlier webhookd · github.com/ncarlier/webhookd) - [CVE-2026-55887](https://cve.now/CVE-2026-55887.md): MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway (CVSS 8.7, docker mcp-gateway · github.com/docker/mcp-gateway) - [CVE-2026-55770](https://cve.now/CVE-2026-55770.md): OpenBao: LDAPi ldaputil (wrong escape func) (CVSS 6.8, openbao · github.com/openbao/openbao) - [CVE-2026-55776](https://cve.now/CVE-2026-55776.md): OpenBao: Transit secrets engine crashes on key creation with \`derived: true\` for asymmetric key types (CVSS 6.5, openbao · github.com/openbao/openbao) - [CVE-2026-55774](https://cve.now/CVE-2026-55774.md): OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 (CVSS 2.1, openbao · github.com/openbao/openbao) - [CVE-2026-55775](https://cve.now/CVE-2026-55775.md): OpenBao's System Backend allows Unauthorized Management of the containing Namespace (CVSS 2.3, openbao · github.com/openbao/openbao) - [CVE-2026-44163](https://cve.now/CVE-2026-44163.md): fluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in \`in\_opentelemetry\` (CVSS 5.3, fluent-plugins-nursery fluent-plugin-opentelemetry · fluent…) - [CVE-2026-77866](https://cve.now/CVE-2026-77866.md): SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts (CVSS 9.0, Slab safeurl · safeurl) - [CVE-2026-55591](https://cve.now/CVE-2026-55591.md): Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints (CVSS 5.8, signalk-server) - [CVE-2026-77972](https://cve.now/CVE-2026-77972.md): safeurl validated address is not bound to the request, allowing DNS rebinding (CVSS 9.0, Slab safeurl · safeurl) - [CVE-2026-55864](https://cve.now/CVE-2026-55864.md): GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool (CVSS 7.8, core-geonetwork · org.geonetwork-opensource:gn-web-app) - [CVE-2026-55630](https://cve.now/CVE-2026-55630.md): Kiwi TCMS: Stored XSS via javascript: URI in extra\_link field (TestPlan & TestCase) (CVSS 0.0, kiwitcms Kiwi · kiwitcms) - [CVE-2026-54724](https://cve.now/CVE-2026-54724.md): Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint (CVSS 6.1, kiwitcms Kiwi · kiwitcms) - [CVE-2026-91849](https://cve.now/CVE-2026-91849.md): WuzhiCMS Avatar Upload index.php setAvatar unrestricted upload (CVSS 5.3, WuzhiCMS) - [CVE-2026-55211](https://cve.now/CVE-2026-55211.md): surfio IRAP header size fields cause out-of-bounds reads (CVSS 9.8, equinor surfio · surfio) - [CVE-2026-55636](https://cve.now/CVE-2026-55636.md): Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected (CVSS 5.7, projectcapsule capsule · github.com/projectcapsule/capsule) - [CVE-2026-44282](https://cve.now/CVE-2026-44282.md): Election question titles allow stored script execution (CVSS 4.8, decidim · decidim-elections) - [CVE-2026-89307](https://cve.now/CVE-2026-89307.md): HTML injection allows open redirection in WordPress theme design-scuole-wordpress-theme (CVSS 5.1, Developers Italia design-scuole-wordpress-theme) - [CVE-2026-19407](https://cve.now/CVE-2026-19407.md): GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK (CVSS 7.7, Google Cloud Gemini Enterprise Agent Platform SDK for Python) - [CVE-2026-87793](https://cve.now/CVE-2026-87793.md): Reflected XSS in WordPress theme design-scuole-wordpress-theme (CVSS 5.1, Developers Italia design-scuole-wordpress-theme) - [CVE-2026-87792](https://cve.now/CVE-2026-87792.md): Multiple authorization bypass in WordPress theme design-scuole-wordpress-theme (CVSS 8.7, Developers Italia design-scuole-wordpress-theme) - [CVE-2026-91992](https://cve.now/CVE-2026-91992.md): Tornado before 6.5.7 Credential Leak via Handle Reuse (CVSS 8.2, tornadoweb tornado · tornado) - [CVE-2026-91991](https://cve.now/CVE-2026-91991.md): Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs (CVSS 6.3, tornadoweb tornado · tornado) - [CVE-2026-65831](https://cve.now/CVE-2026-65831.md): ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read (CVSS 7.7, ArcadeData arcadedb · com.arcadedb arcadedb-server +1) - [CVE-2026-91990](https://cve.now/CVE-2026-91990.md): Tornado before 6.5.8 Memory Amplification DoS via multipart (CVSS 8.7, tornadoweb tornado · tornado) - [CVE-2026-91989](https://cve.now/CVE-2026-91989.md): atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py (CVSS 8.7, dep0we atomic-agents-stack · atomic-agents-stack) - [CVE-2026-91988](https://cve.now/CVE-2026-91988.md): atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP (CVSS 9.2, dep0we atomic-agents-stack · atomic-agents-stack) - [CVE-2026-91987](https://cve.now/CVE-2026-91987.md): atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Model (CVSS 7.1, dep0we atomic-agents-stack · atomic-agents-stack) - [CVE-2026-91986](https://cve.now/CVE-2026-91986.md): gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection (CVSS 5.3, GitoxideLabs gitoxide) - [CVE-2026-91985](https://cve.now/CVE-2026-91985.md): Vikunja before 2.6.0 Privilege Escalation via Link Share Hash (CVSS 8.7, go-vikunja vikunja · code.vikunja.io/api) - [CVE-2026-91984](https://cve.now/CVE-2026-91984.md): Vikunja before 2.6.0 Broken Object-Level Authorization via task-position (CVSS 5.3, go-vikunja vikunja · code.vikunja.io/api) - [CVE-2026-91983](https://cve.now/CVE-2026-91983.md): Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter (CVSS 5.3, go-vikunja vikunja · code.vikunja.io/api) - [CVE-2026-91982](https://cve.now/CVE-2026-91982.md): Vikunja before 2.6.0 TOTP Secret Disclosure via API (CVSS 4.3, go-vikunja vikunja · code.vikunja.io/api) - [CVE-2026-91981](https://cve.now/CVE-2026-91981.md): Vikunja before 2.6.0 User Enumeration via v2 API (CVSS 4.3, go-vikunja vikunja · code.vikunja.io/api) - [CVE-2026-91980](https://cve.now/CVE-2026-91980.md): vikunja before 2.6.0 Team Enumeration via Project Share (CVSS 4.3, go-vikunja vikunja · code.vikunja.io/api) - [CVE-2026-91979](https://cve.now/CVE-2026-91979.md): Vikunja before 2.6.0 Denial of Service via Decompression Bomb (CVSS 6.5, go-vikunja vikunja · code.vikunja.io/api) - [CVE-2026-91973](https://cve.now/CVE-2026-91973.md): Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth (CVSS 8.7, go-vikunja vikunja · code.vikunja.io/api) - [CVE-2026-91972](https://cve.now/CVE-2026-91972.md): Vikunja before 2.6.0 Authentication Bypass via Unthrottled API (CVSS 8.7, go-vikunja vikunja · code.vikunja.io/api) - [CVE-2026-91971](https://cve.now/CVE-2026-91971.md): Vikunja before 2.6.0 Denial of Service via Avatar Upload (CVSS 7.1, go-vikunja vikunja · code.vikunja.io/api) - [CVE-2026-91970](https://cve.now/CVE-2026-91970.md): Vikunja before 2.6.0 Resource Exhaustion via Planka Migration (CVSS 6.5, go-vikunja vikunja · code.vikunja.io/api) - [CVE-2026-91969](https://cve.now/CVE-2026-91969.md): vikunja before 2.6.0 Resource Exhaustion via CSV Migration (CVSS 6.5, go-vikunja vikunja · code.vikunja.io/api) - [CVE-2026-91968](https://cve.now/CVE-2026-91968.md): vikunja before 2.6.0 Denial of Service via unbounded filter recursion (CVSS 6.5, go-vikunja vikunja · code.vikunja.io/api) - [CVE-2026-91967](https://cve.now/CVE-2026-91967.md): AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL (CVSS 5.3, WWBN AVideo) - [CVE-2026-91966](https://cve.now/CVE-2026-91966.md): AVideo through 29.0 Unauthenticated SSRF via Host Header (CVSS 6.9, WWBN AVideo) - [CVE-2026-91965](https://cve.now/CVE-2026-91965.md): WWBN AVideo through 29.0 Broken Access Control via Live Endpoints (CVSS 8.7, WWBN AVideo) - [CVE-2026-91964](https://cve.now/CVE-2026-91964.md): FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken (CVSS 8.7, FreeRDP) - [CVE-2026-91963](https://cve.now/CVE-2026-91963.md): FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc (CVSS 7.1, FreeRDP) - [CVE-2026-91962](https://cve.now/CVE-2026-91962.md): FreeRDP before 3.31.0 Integer Overflow via audin Apple backends (CVSS 5.3, FreeRDP) - [CVE-2026-91961](https://cve.now/CVE-2026-91961.md): FreeRDP before 3.31.0 Denial of Service via URBDRC (CVSS 7.1, FreeRDP) - [CVE-2026-91960](https://cve.now/CVE-2026-91960.md): FreeRDP before 3.31.0 Integer Overflow Double Free (CVSS 6.5, FreeRDP) - [CVE-2026-91959](https://cve.now/CVE-2026-91959.md): FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway (CVSS 6.5, FreeRDP) - [CVE-2026-91958](https://cve.now/CVE-2026-91958.md): FreeRDP 3.11.0 through 3.30.0 Heap Buffer Overflow via Monitor Index (CVSS 6.9, FreeRDP) - [CVE-2026-91957](https://cve.now/CVE-2026-91957.md): FreeRDP before 3.31.0 Use-After-Free via smartcard worker (CVSS 2.3, FreeRDP) - [CVE-2026-91956](https://cve.now/CVE-2026-91956.md): FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC (CVSS 7.1, FreeRDP) - [CVE-2026-91955](https://cve.now/CVE-2026-91955.md): FreeRDP before 3.31.0 Denial of Service via Desktop Dimensions (CVSS 8.2, FreeRDP) - [CVE-2026-91954](https://cve.now/CVE-2026-91954.md): FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec (CVSS 7.1, FreeRDP) - [CVE-2026-91953](https://cve.now/CVE-2026-91953.md): FreeRDP before 3.31.0 Heap Buffer Overflow via LB\_LOAD\_BALANCE\_INFO (CVSS 7.1, FreeRDP) - [CVE-2026-91952](https://cve.now/CVE-2026-91952.md): FreeRDP before 3.31.0 Denial of Service via pool\_decode\_rect (CVSS 7.1, FreeRDP) - [CVE-2026-91951](https://cve.now/CVE-2026-91951.md): FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrc (CVSS 7.1, FreeRDP) - [CVE-2026-91950](https://cve.now/CVE-2026-91950.md): FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparound (CVSS 7.1, FreeRDP) - [CVE-2026-91949](https://cve.now/CVE-2026-91949.md): FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass (CVSS 9.2, FreeRDP) - [CVE-2026-91948](https://cve.now/CVE-2026-91948.md): FreeRDP before 3.31.0 Out-of-bounds Write via SHOW\_PROTOCOL (CVSS 7.7, FreeRDP) - [CVE-2026-91947](https://cve.now/CVE-2026-91947.md): FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVC (CVSS 7.7, FreeRDP) - [CVE-2026-91946](https://cve.now/CVE-2026-91946.md): FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics (CVSS 7.1, FreeRDP) - [CVE-2026-91945](https://cve.now/CVE-2026-91945.md): FreeRDP before 3.31.0 Out-of-bounds Read via Smartcard ATR (CVSS 7.1, FreeRDP) - [CVE-2026-91944](https://cve.now/CVE-2026-91944.md): crawl4ai before 0.9.3 DOM-based XSS via Playground UI (CVSS 5.1, unclecode crawl4ai) - [CVE-2026-91943](https://cve.now/CVE-2026-91943.md): Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy (CVSS 8.3, unclecode crawl4ai) - [CVE-2026-91942](https://cve.now/CVE-2026-91942.md): crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML (CVSS 5.1, unclecode crawl4ai) - [CVE-2026-91941](https://cve.now/CVE-2026-91941.md): Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy (CVSS 8.7, unclecode crawl4ai) - [CVE-2026-91940](https://cve.now/CVE-2026-91940.md): crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy (CVSS 8.7, unclecode crawl4ai) - [CVE-2026-91938](https://cve.now/CVE-2026-91938.md): Flowise before 3.1.4 Server-Side Request Forgery via document loaders (CVSS 7.1, FlowiseAI Flowise) - [CVE-2026-91937](https://cve.now/CVE-2026-91937.md): Flowise before 3.1.4 NoSQL Injection via sessionId (CVSS 7.5, FlowiseAI Flowise) - [CVE-2026-91936](https://cve.now/CVE-2026-91936.md): Flowise before 3.1.4 Script Injection via Docker Workflows (CVSS 6.8, FlowiseAI Flowise) - [CVE-2026-91935](https://cve.now/CVE-2026-91935.md): Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes (CVSS 8.3, FlowiseAI Flowise) - [CVE-2026-91934](https://cve.now/CVE-2026-91934.md): Flowise before 3.1.4 Remote Code Execution via SQL Database Chain (CVSS 8.8, FlowiseAI Flowise) - [CVE-2026-91933](https://cve.now/CVE-2026-91933.md): Flowise before 3.1.4 Authorization Bypass via openai-realtime (CVSS 7.1, FlowiseAI Flowise) - [CVE-2026-91932](https://cve.now/CVE-2026-91932.md): Flowise before 3.1.4 Remote Code Execution via cwd Parameter (CVSS 8.5, FlowiseAI Flowise) - [CVE-2026-91931](https://cve.now/CVE-2026-91931.md): Flowise before 3.1.4 Remote Code Execution via Custom MCP npx (CVSS 8.5, FlowiseAI Flowise) - [CVE-2026-91930](https://cve.now/CVE-2026-91930.md): Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover (CVSS 7.5, FlowiseAI Flowise) - [CVE-2026-91929](https://cve.now/CVE-2026-91929.md): Flowise before 3.1.4 Cross-Tenant Authorization Bypass (CVSS 7.1, FlowiseAI Flowise) - [CVE-2024-58384](https://cve.now/CVE-2024-58384.md): Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient (CVSS 6.3, tornadoweb tornado · tornado) - [CVE-2024-14029](https://cve.now/CVE-2024-14029.md): Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding (CVSS 9.0, tornadoweb tornado · tornado) - [CVE-2023-54397](https://cve.now/CVE-2023-54397.md): Tornado before 6.3.3 HTTP Request Smuggling via Content-Length (CVSS 9.0, tornadoweb tornado · tornado) - [CVE-2026-54077](https://cve.now/CVE-2026-54077.md): ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users (CVSS 7.1, ArcadeData arcadedb · com.arcadedb arcadedb-engine +1) - [CVE-2026-54076](https://cve.now/CVE-2026-54076.md): ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221) (CVSS 8.1, ArcadeData arcadedb · com.arcadedb arcadedb-engine +1) - [CVE-2026-91848](https://cve.now/CVE-2026-91848.md): WuzhiCMS index.php getDataOfJson sql injection (CVSS 6.9, WuzhiCMS) - [CVE-2026-55828](https://cve.now/CVE-2026-55828.md): qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination) (CVSS 6.0, qbee-io transport · go.qbee.io/transport) - [CVE-2026-59973](https://cve.now/CVE-2026-59973.md): mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi (CVSS 8.5, agentfront frontmcp · agentfront mcp-from-openapi +4) - [CVE-2026-87791](https://cve.now/CVE-2026-87791.md): Path traversal vulnerability in WordPress theme design-scuole-wordpress-theme (CVSS 8.7, Developers Italia design-scuole-wordpress-theme) - [CVE-2026-85013](https://cve.now/CVE-2026-85013.md): Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters (CVSS 7.3, Red Hat Enterprise Linux · Red Hat Hardened Images +1) - [CVE-2026-47215](https://cve.now/CVE-2026-47215.md): Singularity: Incorrect path matching for 'limit container paths' directive (CVSS 4.8, sylabs singularity · sylabs SingularityPRO +2) - [CVE-2026-55701](https://cve.now/CVE-2026-55701.md): OpenTelemetry githubreceiver silently ignores configured required\_headers authentication (CVSS 6.9, open-telemetry opentelemetry-collector-contrib · github.com…) - [CVE-2026-50024](https://cve.now/CVE-2026-50024.md): GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via a malicious .git server (CVSS 5.3, WangYihang GitHacker · githacker) - [CVE-2026-91842](https://cve.now/CVE-2026-91842.md): OpenBankProject OBP-API Kryo Redis.scala KryoInjection.invert deserialization (CVSS 2.1, OpenBankProject OBP-API) - [CVE-2026-55178](https://cve.now/CVE-2026-55178.md): GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile… (CVSS 7.5, geolens-io geolens · @geolens/sdk +2) - [CVE-2026-61549](https://cve.now/CVE-2026-61549.md): Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend (CVSS 9.0, woodpecker-ci woodpecker · github.com/woodpecker-ci/wood… +3) - [CVE-2026-50166](https://cve.now/CVE-2026-50166.md): Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured (CVSS 5.5, kumahq kuma · github.com/kumahq/kuma +1) - [CVE-2026-63696](https://cve.now/CVE-2026-63696.md): Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability. (CVSS 9.1, Dell SmartFabric OS10 Software) - [CVE-2026-52724](https://cve.now/CVE-2026-52724.md): kuma-dp connects to control plane without verifying TLS certificate when no CA is configured (CVSS 5.8, kumahq kuma · github.com/kumahq/kuma +1) - [CVE-2026-63695](https://cve.now/CVE-2026-63695.md): Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Session Fixation vulnerability. (CVSS 9.8, Dell SmartFabric OS10 Software) - [CVE-2026-55158](https://cve.now/CVE-2026-55158.md): Conflibot: Command injection via crafted pull request branch names under pull\_request\_target (CVSS 9.1, wktk conflibot) - [CVE-2026-55617](https://cve.now/CVE-2026-55617.md): Hydro: Insufficient session expiration when recreating sessions (CVSS 6.9, hydro-dev Hydro · hydrooj) - [CVE-2026-91836](https://cve.now/CVE-2026-91836.md): OpenClaw ClawScan Static Scanner static\_scanner.go incomplete comparison with missing factors (CVSS 2.4, OpenClaw ClawScan) - [CVE-2026-47780](https://cve.now/CVE-2026-47780.md): free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence (CVSS 6.9, free5gc · github.com/free5gc/udr) - [CVE-2026-48987](https://cve.now/CVE-2026-48987.md): pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager (CVSS 6.5, pyload · pyload-ng) - [CVE-2026-48737](https://cve.now/CVE-2026-48737.md): pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs (CVSS 4.9, pyload · pyload-ng) - [CVE-2026-53966](https://cve.now/CVE-2026-53966.md): XWiki Platform: Privilege escalation from edit to script right through Live Data editing (CVSS 7.1, xwiki-platform · org.xwiki.platform:xwiki-platform-livedata…) - [CVE-2026-55650](https://cve.now/CVE-2026-55650.md): Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure (CVSS 4.4, outerbase studio · @outerbase/studio) - [CVE-2026-53957](https://cve.now/CVE-2026-53957.md): Contentful MCP Server: export\_space/import\_space tools pass LLM-controlled \`host\`/\`proxy\` args to CMA client, redirecting server PAT to… (CVSS 7.7, contentful-mcp-server · @contentful mcp-server +3) - [CVE-2026-54254](https://cve.now/CVE-2026-54254.md): Cyberdrop-DL: Pixeldrain API key shared with unverified thirdparty sites (CVSS 5.9, cyberdrop-dl · cyberdrop-dl-patched) - [CVE-2026-49446](https://cve.now/CVE-2026-49446.md): Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server (CVSS 6.1, azukaar Cosmos-Server · github.com/azukaar/cosmos-server) - [CVE-2026-54167](https://cve.now/CVE-2026-54167.md): Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header (CVSS 8.2, tektoncd pipelines-as-code · github.com/openshift-pipelines…) - [CVE-2026-54168](https://cve.now/CVE-2026-54168.md): Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution (CVSS 6.5, tektoncd pipelines-as-code · github.com/openshift-pipelines…) - [CVE-2026-90439](https://cve.now/CVE-2026-90439.md): NGINX ngx\_http\_v3\_module vulnerability (CVSS 6.5, F5 NGINX Plus · F5 NGINX Open Source) - [CVE-2026-39919](https://cve.now/CVE-2026-39919.md): Ghostscript \< 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter (CVSS 9.3, Artifex Software Ghostscript) - [CVE-2026-57586](https://cve.now/CVE-2026-57586.md): CodeRAG: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution (CVSS 8.6, naranor agent-coderag · agent-coderag) - [CVE-2026-91835](https://cve.now/CVE-2026-91835.md): OpenClaw ClawScan File Classifier static\_scanner.go IsBinaryFile interpretation conflict (CVSS 2.4, OpenClaw ClawScan) - [CVE-2026-89025](https://cve.now/CVE-2026-89025.md): Hirschmann HiOS Switch Platform DoS via Malformed HTTP Request (CVSS 8.7, Belden Hirschmann HiOS Switch Platform) - [CVE-2026-59971](https://cve.now/CVE-2026-59971.md): MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure) (CVSS 10.0, designcomputer mysql\_mcp\_server · mysql-mcp-server) - [CVE-2026-46495](https://cve.now/CVE-2026-46495.md): OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI (CVSS 9.2, OpenIdentityPlatform OpenDJ · org.openidentityplatform.o… +1) - [CVE-2026-48722](https://cve.now/CVE-2026-48722.md): Nextflow: Incorrect default permissions in the nextflow auth login command (CVSS 5.5, nextflow-io nextflow · io.nextflow:nextflow) - [CVE-2026-49254](https://cve.now/CVE-2026-49254.md): Dragonfly Manager OAuth provider client\_secret disclosure via unauthenticated GET /api/v1/oauth (CVSS 2.9, dragonflyoss dragonfly · d7y.io/dragonfly/v2) - [CVE-2026-54637](https://cve.now/CVE-2026-54637.md): Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile (CVSS 5.5, dragonflyoss dragonfly · d7y.io/dragonfly/v2) - [CVE-2026-92082](https://cve.now/CVE-2026-92082.md): Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts (CVSS 6.3, Payara Server) - [CVE-2026-90650](https://cve.now/CVE-2026-90650.md): MotoPress Hotel Booking \<= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id' (CVSS 7.2, jetmonsters MotoPress Hotel Booking) - [CVE-2026-16141](https://cve.now/CVE-2026-16141.md): OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value (CVSS 8.1, OpenBMC phosphor-net-ipmid) - [CVE-2026-16140](https://cve.now/CVE-2026-16140.md): OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1 (CVSS 8.8, OpenBMC phosphor-net-ipmid) - [CVE-2026-77179](https://cve.now/CVE-2026-77179.md): Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback (CVSS 9.4, Docker Sandboxes) - [CVE-2026-14805](https://cve.now/CVE-2026-14805.md): Consulting - Business, Finance WordPress Theme \<= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX (CVSS 8.8, StylemixThemes Consulting - Business, Finance WordPress The…) - [CVE-2026-15609](https://cve.now/CVE-2026-15609.md): Bridge - Creative Multipurpose WordPress Theme \<= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle\_line'… (CVSS 6.4, QODE Bridge - Creative Multipurpose WordPress Theme) - [CVE-2026-92079](https://cve.now/CVE-2026-92079.md): Mitigation bypass in the Widget: Win32 component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92078](https://cve.now/CVE-2026-92078.md): Denial-of-service in the Security component (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92077](https://cve.now/CVE-2026-92077.md): Denial-of-service in the SVG component (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92076](https://cve.now/CVE-2026-92076.md): Incorrect boundary conditions in the Networking component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92075](https://cve.now/CVE-2026-92075.md): Mitigation bypass in the Networking component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92074](https://cve.now/CVE-2026-92074.md): Mitigation bypass in the Popup Blocker component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92073](https://cve.now/CVE-2026-92073.md): Privilege escalation in the Enterprise Policies component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92072](https://cve.now/CVE-2026-92072.md): Incorrect boundary conditions in the Safe Browsing component (CVSS 8.0, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92071](https://cve.now/CVE-2026-92071.md): Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92070](https://cve.now/CVE-2026-92070.md): Information disclosure in the Networking component (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92069](https://cve.now/CVE-2026-92069.md): Spoofing issue in the DOM: Navigation component (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92068](https://cve.now/CVE-2026-92068.md): Site isolation issue in the Reader Mode component (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92067](https://cve.now/CVE-2026-92067.md): Use-after-free in the Widget: Gtk component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92066](https://cve.now/CVE-2026-92066.md): Sandbox escape in the Profile Backup component (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92065](https://cve.now/CVE-2026-92065.md): Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92064](https://cve.now/CVE-2026-92064.md): Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92063](https://cve.now/CVE-2026-92063.md): Denial-of-service in the Audio/Video component (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92062](https://cve.now/CVE-2026-92062.md): Privilege escalation in the Session Restore component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92061](https://cve.now/CVE-2026-92061.md): Incorrect boundary conditions in the Security: Process Sandboxing component (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92060](https://cve.now/CVE-2026-92060.md): Use-after-free in the Internationalization component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92059](https://cve.now/CVE-2026-92059.md): Incorrect boundary conditions in the DOM: Editor component (CVSS 9.3, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92058](https://cve.now/CVE-2026-92058.md): Use-after-free in the Graphics component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92057](https://cve.now/CVE-2026-92057.md): Mitigation bypass in the Enterprise Policies component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92056](https://cve.now/CVE-2026-92056.md): Use-after-free in the Graphics: Text component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92055](https://cve.now/CVE-2026-92055.md): Privilege escalation in the DevTools component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92054](https://cve.now/CVE-2026-92054.md): Privilege escalation in the Memory component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92053](https://cve.now/CVE-2026-92053.md): Privilege escalation in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92052](https://cve.now/CVE-2026-92052.md): Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92051](https://cve.now/CVE-2026-92051.md): Spoofing issue due to invalid pointer in the Graphics component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92050](https://cve.now/CVE-2026-92050.md): Sandbox escape due to race condition in the XPConnect component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92049](https://cve.now/CVE-2026-92049.md): Use-after-free in the Widget: Win32 component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92048](https://cve.now/CVE-2026-92048.md): Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVSS 9.0, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92047](https://cve.now/CVE-2026-92047.md): Privilege escalation in the Crash Reporting component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92046](https://cve.now/CVE-2026-92046.md): Use-after-free in the Graphics component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92045](https://cve.now/CVE-2026-92045.md): Sandbox escape due to incorrect boundary conditions in the WebRTC component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92044](https://cve.now/CVE-2026-92044.md): Information disclosure in the Networking: HTTP component (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92043](https://cve.now/CVE-2026-92043.md): Privilege escalation due to incorrect boundary conditions in the Audio/Video component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92042](https://cve.now/CVE-2026-92042.md): Race condition in the DOM: Content Processes component (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92041](https://cve.now/CVE-2026-92041.md): Mitigation bypass in the DOM: Networking component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92040](https://cve.now/CVE-2026-92040.md): Use-after-free in the JavaScript: WebAssembly component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92039](https://cve.now/CVE-2026-92039.md): Mitigation bypass in the DOM: Notifications component (CVSS 6.3, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92038](https://cve.now/CVE-2026-92038.md): Mitigation bypass in the Remote Settings Client component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92037](https://cve.now/CVE-2026-92037.md): Incorrect boundary conditions in the DOM: Animation component (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92036](https://cve.now/CVE-2026-92036.md): Incorrect boundary conditions in the Networking: HTTP component (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92035](https://cve.now/CVE-2026-92035.md): Sandbox escape due to incorrect boundary conditions in the Graphics component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92034](https://cve.now/CVE-2026-92034.md): Site isolation issue in the Graphics component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92033](https://cve.now/CVE-2026-92033.md): Privilege escalation in Firefox for Android (CVSS 8.8, Mozilla Firefox) - [CVE-2026-92032](https://cve.now/CVE-2026-92032.md): Sandbox escape due to invalid pointer in the Graphics component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92031](https://cve.now/CVE-2026-92031.md): Information disclosure in the Graphics: ImageLib component (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92030](https://cve.now/CVE-2026-92030.md): Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92029](https://cve.now/CVE-2026-92029.md): Use-after-free in the SVG component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92028](https://cve.now/CVE-2026-92028.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92027](https://cve.now/CVE-2026-92027.md): Use-after-free in the DOM: Streams component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92026](https://cve.now/CVE-2026-92026.md): Use-after-free in the Networking component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92025](https://cve.now/CVE-2026-92025.md): Use-after-free in the DOM: Navigation component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92024](https://cve.now/CVE-2026-92024.md): Use-after-free in the SVG component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92023](https://cve.now/CVE-2026-92023.md): Use-after-free in the XML component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92022](https://cve.now/CVE-2026-92022.md): Use-after-free in the DOM: HTML Parser component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92021](https://cve.now/CVE-2026-92021.md): Use-after-free in the JavaScript Engine: JIT component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92020](https://cve.now/CVE-2026-92020.md): Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92019](https://cve.now/CVE-2026-92019.md): Mitigation bypass in the Remote Settings Client component (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92018](https://cve.now/CVE-2026-92018.md): Sandbox escape in the DOM: Core & HTML component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92017](https://cve.now/CVE-2026-92017.md): Privilege escalation in the DOM: Service Workers component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92016](https://cve.now/CVE-2026-92016.md): Use-after-free in the Disability Access APIs component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92015](https://cve.now/CVE-2026-92015.md): Privilege escalation in the WebExtensions component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92014](https://cve.now/CVE-2026-92014.md): Privilege escalation due to incorrect boundary conditions in the Graphics component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92013](https://cve.now/CVE-2026-92013.md): Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92012](https://cve.now/CVE-2026-92012.md): Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92011](https://cve.now/CVE-2026-92011.md): Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92010](https://cve.now/CVE-2026-92010.md): Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92009](https://cve.now/CVE-2026-92009.md): Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92008](https://cve.now/CVE-2026-92008.md): Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92007](https://cve.now/CVE-2026-92007.md): Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92006](https://cve.now/CVE-2026-92006.md): Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-92005](https://cve.now/CVE-2026-92005.md): Use-after-free in the Audio/Video: Web Codecs component (CVSS 5.3, Mozilla Firefox · Mozilla Thunderbird) - [CVE-2026-91926](https://cve.now/CVE-2026-91926.md): Gss-ntlmssp: gss-ntlmssp: memory leak in ntlm\_decode\_target\_info via duplicated av\_pair entries in ntlm challenge (CVSS 3.7, Red Hat Enterprise Linux) - [CVE-2026-89308](https://cve.now/CVE-2026-89308.md): Arbitrary command execution in TrxTimeATTENDANCE (CVSS 9.3, TREXOM TrxTimeATTENDANCE) - [CVE-2026-92003](https://cve.now/CVE-2026-92003.md): MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion (CVSS 6.9, MISP) - [CVE-2026-91998](https://cve.now/CVE-2026-91998.md): Casdoor through 4.4.0 Cross-Organization User Administration via /api/mcp (CVSS 9.4, casdoor) - [CVE-2026-91997](https://cve.now/CVE-2026-91997.md): evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass (CVSS 6.9, evolution-foundation evolution-api) - [CVE-2026-91996](https://cve.now/CVE-2026-91996.md): lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint (CVSS 8.7, dromara lamp-cloud) - [CVE-2026-91995](https://cve.now/CVE-2026-91995.md): pig before 4.1.0 Unverified Password Change via /register/password (CVSS 9.3, pig-mesh pig) - [CVE-2026-91994](https://cve.now/CVE-2026-91994.md): Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests (CVSS 7.1, semaphoreui semaphore) - [CVE-2026-91993](https://cve.now/CVE-2026-91993.md): Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list (CVSS 5.3, dromara Jpom) - [CVE-2026-92002](https://cve.now/CVE-2026-92002.md): MISP: Authentication failure logging suppressed during Redis unavailability (CVSS 5.1, MISP) - [CVE-2026-91786](https://cve.now/CVE-2026-91786.md): Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size (CVSS 6.1, Red Hat Enterprise Linux) - [CVE-2026-91925](https://cve.now/CVE-2026-91925.md): Polyaxon through 2.16.4 Server-Side Template Injection via Unsandboxed Jinja2 Engine (CVSS 8.7, polyaxon) - [CVE-2026-91924](https://cve.now/CVE-2026-91924.md): pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint (CVSS 8.4, sosedoff pgweb) - [CVE-2026-91923](https://cve.now/CVE-2026-91923.md): KubeSphere through 4.1.3 SSRF via git credential verification endpoint (CVSS 8.3, kubesphere) - [CVE-2026-91922](https://cve.now/CVE-2026-91922.md): Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render (CVSS 5.3, steedos-platform) - [CVE-2026-1759](https://cve.now/CVE-2026-1759.md): Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation. (CVSS 6.5, Secomea GateManager) - [CVE-2026-80489](https://cve.now/CVE-2026-80489.md): EUC\_JISX0213 decoding may hang on crafted input (CVSS 5.9, The GNU C Library glibc) - [CVE-2026-1758](https://cve.now/CVE-2026-1758.md): Session Fixation (CVSS 8.3, Secomea GateManager) - [CVE-2026-77117](https://cve.now/CVE-2026-77117.md): SHIFT\_JISX0213 decoding may hang on crafted input (CVSS 5.9, The GNU C Library glibc) - [CVE-2026-52827](https://cve.now/CVE-2026-52827.md): Kimai: Two-factor authentication bypass on the Kimai API (CVSS 7.1, kimai · kimai/kimai) - [CVE-2026-52822](https://cve.now/CVE-2026-52822.md): Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation (CVSS 5.3, kimai · kimai/kimai) - [CVE-2026-52828](https://cve.now/CVE-2026-52828.md): Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access (CVSS 5.3, kimai · kimai/kimai) - [CVE-2026-52826](https://cve.now/CVE-2026-52826.md): Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation (CVSS 5.3, kimai · kimai/kimai) - [CVE-2026-52823](https://cve.now/CVE-2026-52823.md): Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes (CVSS 5.3, kimai · kimai/kimai) - [CVE-2026-86818](https://cve.now/CVE-2026-86818.md): fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization (CVSS 4.8, fast-uri) - [CVE-2026-52824](https://cve.now/CVE-2026-52824.md): Kimai: Default APP\_SECRET in Docker Image Enables Cookie Forgery and Account Takeover (CVSS 9.1, kimai · kimai/kimai) - [CVE-2026-52825](https://cve.now/CVE-2026-52825.md): Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized… (CVSS 5.3, kimai · kimai/kimai) - [CVE-2026-52821](https://cve.now/CVE-2026-52821.md): Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects (CVSS 5.3, kimai · kimai/kimai) - [CVE-2026-52820](https://cve.now/CVE-2026-52820.md): Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query\_builder OR-bypass (CVSS 5.3, kimai · kimai/kimai) - [CVE-2026-52819](https://cve.now/CVE-2026-52819.md): Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the… (CVSS 6.3, kimai · kimai/kimai) - [CVE-2026-57147](https://cve.now/CVE-2026-57147.md): praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery (CVSS 9.8, MervinPraison PraisonAI · MervinPraison praisonai-platfo… +1) - [CVE-2026-57148](https://cve.now/CVE-2026-57148.md): praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) (CVSS 9.8, MervinPraison PraisonAI · MervinPraison praisonai-platfo… +1) - [CVE-2026-86472](https://cve.now/CVE-2026-86472.md): fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets (CVSS 4.8, fast-uri) - [CVE-2026-57140](https://cve.now/CVE-2026-57140.md): PraisonAI AgentOS exposes unauthenticated agent listing and invocation (CVSS 9.4, MervinPraison PraisonAI · praisonai) - [CVE-2026-57139](https://cve.now/CVE-2026-57139.md): PraisonAI MCPServer exposes unauthenticated HTTP tools/call (CVSS 9.8, MervinPraison PraisonAI · praisonai) - [CVE-2026-57133](https://cve.now/CVE-2026-57133.md): PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining (CVSS 8.8, MervinPraison PraisonAI · praisonai) - [CVE-2026-57135](https://cve.now/CVE-2026-57135.md): PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients (CVSS 7.6, MervinPraison PraisonAI · praisonai) - [CVE-2026-57134](https://cve.now/CVE-2026-57134.md): PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation (CVSS 8.2, MervinPraison PraisonAI · praisonai) - [CVE-2026-57138](https://cve.now/CVE-2026-57138.md): PraisonAI codeMode sandbox escape via Function constructor (CVSS 9.9, MervinPraison PraisonAI · praisonai) - [CVE-2026-57136](https://cve.now/CVE-2026-57136.md): PraisonAI SandboxExecutor allowedCommands bypass via shell chaining (CVSS 8.8, MervinPraison PraisonAI · praisonai) - [CVE-2026-57137](https://cve.now/CVE-2026-57137.md): PraisonAI AgentLoop onToolCall approval runs after tool execution (CVSS 8.8, MervinPraison PraisonAI · praisonai) - [CVE-2026-57141](https://cve.now/CVE-2026-57141.md): PraisonAI: Remote Code Execution via Sandbox Escape in \`codeMode\` Tool (CVSS 9.8, MervinPraison PraisonAI · praisonai) - [CVE-2026-57112](https://cve.now/CVE-2026-57112.md): PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools (CVSS 8.3, MervinPraison PraisonAI · MervinPraison praisonaiagents +2) - [CVE-2026-48717](https://cve.now/CVE-2026-48717.md): OpenAM OAuth Authorization Bypass via PKCE Challenge (CVSS 9.1, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2026-47426](https://cve.now/CVE-2026-47426.md): OpenAM OAuth Client Impersonation via JWKS Resolver Cache (CVSS 7.6, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2026-47424](https://cve.now/CVE-2026-47424.md): OpenAM Authenticated RCE via Groovy Sandbox Escape (CVSS 7.5, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2026-41573](https://cve.now/CVE-2026-41573.md): OpenAM LDAP Injection via \`\_queryId\` Parameter (CVSS 7.1, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2026-62280](https://cve.now/CVE-2026-62280.md): OpenAM Reflected XSS in the OAuth2/OIDC \`wap\` consent page (CVSS 6.1, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2025-13166](https://cve.now/CVE-2025-13166.md): Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery (CVSS 3.7, WSO2 Identity Server) - [CVE-2025-5802](https://cve.now/CVE-2025-5802.md): Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery (CVSS 5.3, WSO2 API Manager · WSO2 API Control Plane +7) - [CVE-2026-19515](https://cve.now/CVE-2026-19515.md): OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution (CVSS 7.0, WSO2 Integrator: MI for Visual Studio Code) - [CVE-2026-45051](https://cve.now/CVE-2026-45051.md): OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage (CVSS 9.2, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2026-62263](https://cve.now/CVE-2026-62263.md): OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth\>1 bypass (CVSS 9.2, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2026-46623](https://cve.now/CVE-2026-46623.md): OpenAM Account Takeover via Unverified Password Change in OAuth2 Module (CVSS 7.4, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2026-46619](https://cve.now/CVE-2026-46619.md): OpenAM Authentication Bypass via MSISDN LDAP Injection (CVSS 9.3, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2026-46498](https://cve.now/CVE-2026-46498.md): OpenAM Arbitrary OAuth Token Minting via Push Registration (CVSS 7.6, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2026-45794](https://cve.now/CVE-2026-45794.md): OpenAM Unsafe Java Deserialization via SNS (CVSS 7.7, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2026-45048](https://cve.now/CVE-2026-45048.md): OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC (CVSS 8.5, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2026-44203](https://cve.now/CVE-2026-44203.md): OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response\_mode=form\_post via state parameter (FormPostResponse.ftl) (CVSS 8.3, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2026-44202](https://cve.now/CVE-2026-44202.md): OpenAM Authenticated Server-Side Request Forgery (SSRF) via \`/sessionservice\` (CVSS 5.3, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2026-62379](https://cve.now/CVE-2026-62379.md): OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback (CVSS 9.8, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2026-53660](https://cve.now/CVE-2026-53660.md): OpenAM Insecure SSO Cookie Initialization (CVSS 7.4, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2026-45052](https://cve.now/CVE-2026-45052.md): OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints (CVSS 9.3, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2026-44793](https://cve.now/CVE-2026-44793.md): OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via \`FSUtils.postToTarget\` (CVSS 7.0, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…) - [CVE-2026-91859](https://cve.now/CVE-2026-91859.md): MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass (CVSS 5.3, MISP) - [CVE-2026-59341](https://cve.now/CVE-2026-59341.md): Sealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpoints (CVSS 4.2, Bitnami sealed-secrets) - [CVE-2026-91857](https://cve.now/CVE-2026-91857.md): MISP: State-changing actions accessible via GET request enabling CSRF (CVSS 5.3, MISP) - [CVE-2026-91782](https://cve.now/CVE-2026-91782.md): GNU Binutils Dynamic Relocation Allocation elfxx-x86.c elf\_x86\_allocate\_dynrelocs null pointer dereference (CVSS 4.8, GNU Binutils) - [CVE-2026-80217](https://cve.now/CVE-2026-80217.md): Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode… (CVSS 8.8, LITE-ON Technology FF-RFI079I4 · LITE-ON Technology FF-RFI0…) - [CVE-2026-91851](https://cve.now/CVE-2026-91851.md): MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison (CVSS 5.3, MISP) - [CVE-2026-77853](https://cve.now/CVE-2026-77853.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4. (CVSS 8.8, LITE-ON Technology FF-RFI079I4 · LITE-ON Technology FF-RFI0…) - [CVE-2026-91826](https://cve.now/CVE-2026-91826.md): Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers to overflow buffers, leading to memory corruption… (CVSS 4.4, Samsung Opensource rLottie) - [CVE-2026-76159](https://cve.now/CVE-2026-76159.md): Duplicati for Windows - Incorrect Permission Assignment for Critical Resource (CVSS 7.0, Duplicati) - [CVE-2026-91781](https://cve.now/CVE-2026-91781.md): GNU Binutils ELF Section elf64-x86-64.c elf\_x86\_64\_common\_section\_index null pointer dereference (CVSS 4.8, GNU Binutils) - [CVE-2026-91846](https://cve.now/CVE-2026-91846.md): MISP Collection Element Add Missing Authorization on Referenced Object UUID (CVSS 7.1, MISP) - [CVE-2026-91780](https://cve.now/CVE-2026-91780.md): GNU Binutils elflink.c elf\_link\_add\_object\_symbols null pointer dereference (CVSS 4.8, GNU Binutils) - [CVE-2026-75092](https://cve.now/CVE-2026-75092.md): Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan\_mysql runs mysqld --validate-config as root and can load… (CVSS 7.3, Red Hat Enterprise Linux · Red Hat OpenStack Platform) - [CVE-2026-91779](https://cve.now/CVE-2026-91779.md): GNU Binutils Eh Frame elf-eh-frame.c \_bfd\_elf\_eh\_frame\_section\_offset null pointer dereference (CVSS 4.8, GNU Binutils) - [CVE-2026-91825](https://cve.now/CVE-2026-91825.md): MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit (CVSS 7.1, MISP) - [CVE-2026-91091](https://cve.now/CVE-2026-91091.md): GPAC Node Insertion base\_scenegraph.c gf\_node\_list\_insert\_child memory corruption (CVSS 5.3, GPAC) - [CVE-2026-91819](https://cve.now/CVE-2026-91819.md): MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent (CVSS 6.9, MISP) - [CVE-2026-91090](https://cve.now/CVE-2026-91090.md): GPAC base\_scenegraph.c gf\_node\_activate\_ex stack-based overflow (CVSS 2.4, GPAC) - [CVE-2026-91089](https://cve.now/CVE-2026-91089.md): GPAC base\_scenegraph.c gf\_node\_get\_name\_and\_id use after free (CVSS 5.3, GPAC) - [CVE-2026-91778](https://cve.now/CVE-2026-91778.md): In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including… (CVSS 7.2, Octopus Deploy Octopus Server) - [CVE-2026-18063](https://cve.now/CVE-2026-18063.md): Job Postings \<= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position\_button' Parameter (CVSS 6.4, blueglassch Job Postings) - [CVE-2026-91088](https://cve.now/CVE-2026-91088.md): GPAC URL url.c gf\_url\_concatenate\_ex heap-based overflow (CVSS 2.4, GPAC) - [CVE-2026-91087](https://cve.now/CVE-2026-91087.md): GPAC Compositor media\_object.c gf\_mo\_get\_od\_id use after free (CVSS 6.9, GPAC) - [CVE-2026-91086](https://cve.now/CVE-2026-91086.md): GPAC MPEG Video Reframer reframe\_mpgvid.c mpgviddmx\_process heap-based overflow (CVSS 5.3, GPAC) - [CVE-2026-90711](https://cve.now/CVE-2026-90711.md): proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet (CVSS 9.1, proxy-addr) - [CVE-2026-91005](https://cve.now/CVE-2026-91005.md): SourceCodester Online Faculty Clearance System Profile Picture Upload edit\_picture.php move\_uploaded\_file unrestricted upload (CVSS 5.3, SourceCodester Online Faculty Clearance System) - [CVE-2026-75983](https://cve.now/CVE-2026-75983.md): Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce \<= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via… (CVSS 7.5, arraytics Eventin – Event Calendar, Tickets, Registration,…) - [CVE-2026-15402](https://cve.now/CVE-2026-15402.md): Eventin \<= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn\_shedule\_objective' schedule\_slot Parameter (CVSS 6.4, arraytics Eventin – Event Calendar, Tickets, Registration,…) - [CVE-2026-89141](https://cve.now/CVE-2026-89141.md): AI Engine \<= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter (CVSS 6.5, tigroumeow AI Engine – The Chatbot, AI Framework & MCP for…) - [CVE-2026-91004](https://cve.now/CVE-2026-91004.md): SourceCodester Online Faculty Clearance System delete\_faculty1.php sql injection (CVSS 6.9, SourceCodester Online Faculty Clearance System) - [CVE-2026-18232](https://cve.now/CVE-2026-18232.md): WP Directory Kit \<= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map\_infowindow (CVSS 5.3, WP Directory Kit) - [CVE-2026-16592](https://cve.now/CVE-2026-16592.md): WP Directory Kit \<= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes (CVSS 2.7, WP Directory Kit) - [CVE-2026-16593](https://cve.now/CVE-2026-16593.md): WP Directory Kit \<= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings (CVSS 6.8, WP Directory Kit) - [CVE-2026-86701](https://cve.now/CVE-2026-86701.md): Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. (CVSS 2.5, NTT DOCOMO BUSINESS ManabiPocket for Parents) - [CVE-2026-91003](https://cve.now/CVE-2026-91003.md): D-Link DI-8300 CGI Service rzgl.asp rzgl\_asp stack-based overflow (CVSS 9.4, D-Link DI-8300) - [CVE-2026-17495](https://cve.now/CVE-2026-17495.md): moment vulnerable to Path Traversal via crafted non-string locale name (CVSS 5.9, moment) - [CVE-2026-81320](https://cve.now/CVE-2026-81320.md): Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level (CVSS 5.5, Red Hat build of Apache Camel - HawtIO) - [CVE-2026-81303](https://cve.now/CVE-2026-81303.md): Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname (CVSS 6.3, Red Hat build of Apache Camel - HawtIO) - [CVE-2026-91002](https://cve.now/CVE-2026-91002.md): stamparm maltrail Blacklist Endpoint httpd.py \_blacklist missing authentication (CVSS 6.9, stamparm maltrail) - [CVE-2026-91001](https://cve.now/CVE-2026-91001.md): D-Link DI-8400 DDNS Configuration ddns.asp ddns\_asp stack-based overflow (CVSS 9.4, D-Link DI-8400) - [CVE-2026-15758](https://cve.now/CVE-2026-15758.md): 3D FlipBook \<= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter (CVSS 5.3, iberezansky 3D FlipBook – PDF Embedder, PDF Flipbook Viewer…) - [CVE-2026-90881](https://cve.now/CVE-2026-90881.md): D-Link DIR-882 CGI Binary dllog.cgi main information disclosure (CVSS 6.9, D-Link DIR-882) - [CVE-2026-90880](https://cve.now/CVE-2026-90880.md): D-Link DSL-3782 Diagnostics Diagnostics.asp system command injection (CVSS 5.3, D-Link DSL-3782) - [CVE-2026-90879](https://cve.now/CVE-2026-90879.md): zyx0814 FilePress Publish search.php sql injection (CVSS 6.9, zyx0814 FilePress) - [CVE-2026-90878](https://cve.now/CVE-2026-90878.md): vllm-project vLLM Jinja Template Rendering completions resource consumption (CVSS 5.3, vllm-project vLLM) - [CVE-2026-90877](https://cve.now/CVE-2026-90877.md): SourceCodester Online Faculty Clearance System update\_requirement\_status.php sql injection (CVSS 6.9, SourceCodester Online Faculty Clearance System) - [CVE-2026-90876](https://cve.now/CVE-2026-90876.md): SourceCodester Online Faculty Clearance System delete\_requirement.php sql injection (CVSS 6.9, SourceCodester Online Faculty Clearance System) - [CVE-2026-90858](https://cve.now/CVE-2026-90858.md): subhajitkhan online-clinic-management-system adminappview.php session\_start authorization (CVSS 6.9, subhajitkhan online-clinic-management-system) - [CVE-2026-90857](https://cve.now/CVE-2026-90857.md): SourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted upload (CVSS 5.3, SourceCodester College Notes Gallery Management System) - [CVE-2026-90856](https://cve.now/CVE-2026-90856.md): SourceCodester College Notes Gallery Management System Registration Flow signup.php privileges management (CVSS 6.9, SourceCodester College Notes Gallery Management System) - [CVE-2026-90855](https://cve.now/CVE-2026-90855.md): SourceCodester/katojkalemba Online Food Ordering System order.php sql injection (CVSS 6.9, SourceCodester Online Food Ordering System · katojkalemba O…) - [CVE-2026-90854](https://cve.now/CVE-2026-90854.md): SourceCodester/katojkalemba Online Food Ordering System category-foods.php sql injection (CVSS 6.9, SourceCodester Online Food Ordering System · katojkalemba O…) - [CVE-2026-88262](https://cve.now/CVE-2026-88262.md): Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass. (CVSS 8.7, bizwell xClick) - [CVE-2026-90852](https://cve.now/CVE-2026-90852.md): luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free (CVSS 6.9, luben zstd-jni) - [CVE-2026-88261](https://cve.now/CVE-2026-88261.md): Improper input validation vulnerability in bizwell xClick allows Stored XSS. (CVSS 5.1, bizwell xClick) - [CVE-2026-90851](https://cve.now/CVE-2026-90851.md): PHPGurukul Hostel Management System checklogin.php access control (CVSS 5.3, PHPGurukul Hostel Management System) - [CVE-2026-90850](https://cve.now/CVE-2026-90850.md): PHPGurukul Hostel Management System manage-students.php cross site scripting (CVSS 4.8, PHPGurukul Hostel Management System) - [CVE-2026-90849](https://cve.now/CVE-2026-90849.md): SourceCodester College Notes Gallery Management System login.php sql injection (CVSS 6.9, SourceCodester College Notes Gallery Management System) - [CVE-2026-91774](https://cve.now/CVE-2026-91774.md): Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint (CVSS 5.3, YaoApp yao) - [CVE-2026-91773](https://cve.now/CVE-2026-91773.md): Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks (CVSS 5.3, charmbracelet soft-serve) - [CVE-2026-91772](https://cve.now/CVE-2026-91772.md): Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter (CVSS 6.1, halo-dev halo) - [CVE-2026-91771](https://cve.now/CVE-2026-91771.md): Weights & Biases wandb before 0.29.0 Path Traversal via File Download (CVSS 8.8, wandb) - [CVE-2026-91770](https://cve.now/CVE-2026-91770.md): IceHRM before 36.0.0 Broken Access Control via Employee ID (CVSS 7.1, gamonoid icehrm) - [CVE-2026-90848](https://cve.now/CVE-2026-90848.md): Governikus AusweisApp StartPAOSResponse cross site scripting (CVSS 5.3, Governikus AusweisApp) - [CVE-2026-85657](https://cve.now/CVE-2026-85657.md): Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors \<= 4.15.0 - Authenticated (Author+) Stored… (CVSS 5.4, Co-Authors, Multiple Authors and Guest Authors in an Author…) - [CVE-2026-85575](https://cve.now/CVE-2026-85575.md): The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets \<= 4.9.5… (CVSS 6.4, roxnor ShopEngine Elementor WooCommerce Builder Addon – All…) - [CVE-2026-90847](https://cve.now/CVE-2026-90847.md): EFM ipTIME C200E System Setup iux\_set.cgi os command injection (CVSS 9.4, EFM ipTIME C200E) - [CVE-2026-90846](https://cve.now/CVE-2026-90846.md): PHPGurukul Daily Expense Tracker System forgot-password.php sql injection (CVSS 6.9, PHPGurukul Daily Expense Tracker System) - [CVE-2026-91752](https://cve.now/CVE-2026-91752.md): GNU libextractor before 1.15 Stack Overflow via OLE2 (CVSS 8.7, GNU libextractor) - [CVE-2026-91751](https://cve.now/CVE-2026-91751.md): Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API (CVSS 7.2, flextype) - [CVE-2026-91750](https://cve.now/CVE-2026-91750.md): WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects (CVSS 7.1, Tencent WeKnora) - [CVE-2026-90845](https://cve.now/CVE-2026-90845.md): PHPGurukul Daily Expense Tracker System sidebar.php cross site scripting (CVSS 5.1, PHPGurukul Daily Expense Tracker System) - [CVE-2026-90844](https://cve.now/CVE-2026-90844.md): PHPGurukul Daily Expense Tracker System Login index.php sql injection (CVSS 6.9, PHPGurukul Daily Expense Tracker System) - [CVE-2026-90843](https://cve.now/CVE-2026-90843.md): SabyasachiRana WebMap New Nmap Scan functions\_nmap.py nmap\_newscan os command injection (CVSS 6.9, SabyasachiRana WebMap) - [CVE-2025-66974](https://cve.now/CVE-2025-66974.md): An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a… (CVSS 7.5) - [CVE-2026-25825](https://cve.now/CVE-2026-25825.md): An issue was discovered in Keyfactor SignServer before 7.6.0. (CVSS 2.7) - [CVE-2026-25826](https://cve.now/CVE-2026-25826.md): An issue was discovered in Keyfactor SignServer before 7.6.0. (CVSS 4.9) - [CVE-2026-25827](https://cve.now/CVE-2026-25827.md): An issue was discovered in Keyfactor SignServer before 7.6.0. (CVSS 2.3) - [CVE-2026-37152](https://cve.now/CVE-2026-37152.md): TOTOLINK X5000R V9.1.0cu.2415\_B20250515 was discovered to contain a hardcoded password for root access. (CVSS 9.8) - [CVE-2026-39038](https://cve.now/CVE-2026-39038.md): BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in… (CVSS 6.1) - [CVE-2026-39039](https://cve.now/CVE-2026-39039.md): In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the… (CVSS 5.3) - [CVE-2026-39040](https://cve.now/CVE-2026-39040.md): BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in… (CVSS 5.4) - [CVE-2026-51133](https://cve.now/CVE-2026-51133.md): Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance \<= V6.0104 allows a remote attacker to execute arbitrary… (CVSS 6.1) - [CVE-2026-51134](https://cve.now/CVE-2026-51134.md): The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in… (CVSS 7.5) - [CVE-2026-52484](https://cve.now/CVE-2026-52484.md): An issue in MitraStar GPT-2742GX4X5v6-SV GL\_g2.5\_100XNT0b23\_3 allows an authenticated attacker to execute arbitrary code via the… (CVSS 8.8) - [CVE-2026-79303](https://cve.now/CVE-2026-79303.md): kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. (CVSS 9.9) - [CVE-2026-79409](https://cve.now/CVE-2026-79409.md): An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable… (CVSS 6.5) - [CVE-2026-79410](https://cve.now/CVE-2026-79410.md): Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce… (CVSS 8.1) - [CVE-2026-79411](https://cve.now/CVE-2026-79411.md): Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding… (CVSS 8.8) - [CVE-2026-79425](https://cve.now/CVE-2026-79425.md): An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online\_upload component of CRMEB v6.0.0 allows attackers to scan… (CVSS 8.1) - [CVE-2026-79551](https://cve.now/CVE-2026-79551.md): Tenda Technology Co., Ltd NVR\_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key. (CVSS 7.5) - [CVE-2026-88616](https://cve.now/CVE-2026-88616.md): An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the… (CVSS 8.8) - [CVE-2026-88617](https://cve.now/CVE-2026-88617.md): SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. (CVSS 9.8) - [CVE-2026-88618](https://cve.now/CVE-2026-88618.md): 1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. (CVSS 6.5) - [CVE-2026-88619](https://cve.now/CVE-2026-88619.md): 1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. (CVSS 8.1) - [CVE-2026-88620](https://cve.now/CVE-2026-88620.md): SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. (CVSS 4.3) - [CVE-2026-88621](https://cve.now/CVE-2026-88621.md): OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. (CVSS 2.7) - [CVE-2026-88742](https://cve.now/CVE-2026-88742.md): Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field. (CVSS 5.4) - [CVE-2026-88743](https://cve.now/CVE-2026-88743.md): Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags. (CVSS 6.1) --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/archive/2026-09-15 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.