# CVEs published 2026-06-16

545 CVEs were published on June 16, 2026: 153 critical, 272 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-48797](https://cve.now/CVE-2026-48797.md): Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication (CVSS 9.3, mcp-tool-shop-org backpropagate · mcp-tool-shop-org @mcp… +2)
- [CVE-2026-44587](https://cve.now/CVE-2026-44587.md): CarrierWave has a denylisted\_content\_type bypass via Unescaped Regex Metacharacters (CVSS 4.7, carrierwaveuploader carrierwave · carrierwave)
- [CVE-2026-48616](https://cve.now/CVE-2026-48616.md): Rocket.Chat versions \<8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, 7.13.9, 7.10.13 has an access control vulnerability in Livechat files. (CVSS 9.3, Rocket.Chat)
- [CVE-2026-48929](https://cve.now/CVE-2026-48929.md): Rocket.Chat in versions \<8.5.1, \<8.4.4, \<8.3.6, \<8.2.6, \<8.1.6, \<8.0.7, \<7.13.9, and \<7.10.13 is vulnerable to unauthenticated file deletion (CVSS 7.5, Rocket.Chat)
- [CVE-2026-48782](https://cve.now/CVE-2026-48782.md): pydantic-ai: SSRF blocklist bypass via IPv4-compatible, SIIT/IVI, and local NAT64 IPv6 addresses (incomplete fix of CVE-2026-46678) (CVSS 6.8, pydantic-ai · pydantic-ai-slim)
- [CVE-2026-48788](https://cve.now/CVE-2026-48788.md): Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing (CVSS 8.2, umputun remark42 · github.com/umputun/remark42)
- [CVE-2026-48745](https://cve.now/CVE-2026-48745.md): Traccar Client: silent configuration hijack via unverified deep link redirects all GPS telemetry (CVSS 9.3, traccar-client)
- [CVE-2026-47277](https://cve.now/CVE-2026-47277.md): Runtipi: Unauthenticated arbitrary file read through app-store logo symlinks (CVSS 6.5, runtipi)
- [CVE-2026-48783](https://cve.now/CVE-2026-48783.md): Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription (CVSS 4.8, gitroomhq postiz-app)
- [CVE-2026-2604](https://cve.now/CVE-2026-2604.md): Evolution-data-server: evolution data server: arbitrary file deletion via inconsistent uri handling (CVSS 5.6, GNOME Evolution Data Server · Red Hat Enterprise Linux)
- [CVE-2026-48781](https://cve.now/CVE-2026-48781.md): Postiz has cross-tenant SUPERADMIN takeover via Skool-provider JWT forgery (CVSS 9.9, gitroomhq postiz-app)
- [CVE-2026-48779](https://cve.now/CVE-2026-48779.md): ws: Memory exhaustion DoS from tiny fragments and data chunks (CVSS 7.5, websockets ws · ws)
- [CVE-2026-25470](https://cve.now/CVE-2026-25470.md): WordPress ACPT (Pro) - Custom Post Types plugin for WordPress plugin \< 2.0.52 - Remote Code Execution (RCE) vulnerability (CVSS 10.0, ACPT (Pro) - Custom Post Types Plugin for WordPress)
- [CVE-2026-39598](https://cve.now/CVE-2026-39598.md): WordPress Academy LMS Pro plugin \< 3.5.2 - Arbitrary File Upload vulnerability (CVSS 8.0, Kodezen Academy LMS Pro)
- [CVE-2026-49073](https://cve.now/CVE-2026-49073.md): WordPress Directorist Booking plugin \<= 3.0.3 - SQL Injection vulnerability (CVSS 8.5, wpWax Directorist Booking)
- [CVE-2026-48055](https://cve.now/CVE-2026-48055.md): Streambert: Arbitrary File Write (Zip Slip) via Subtitle Extraction (CVSS 10.0, truelockmc streambert)
- [CVE-2026-11409](https://cve.now/CVE-2026-11409.md): OS Command Injection in IPv6 PPPoE Configuration in TP-Link TL-WR940N (CVSS 8.5, TP-Link Systems TL-WR940N)
- [CVE-2026-11410](https://cve.now/CVE-2026-11410.md): OS Command Injection in BigPond Cable (BPA) Configuration in TP-Link TL-WR940N (CVSS 8.5, TP-Link Systems TL-WR940N)
- [CVE-2026-49113](https://cve.now/CVE-2026-49113.md): WordPress Cornerstone plugin \< 7.8.8 - Arbitrary Code Execution vulnerability (CVSS 8.5, THEMECO Cornerstone)
- [CVE-2026-49080](https://cve.now/CVE-2026-49080.md): WordPress wpDataTables plugin \<= 7.3.6 - SQL Injection vulnerability (CVSS 9.3, TMS wpDataTables)
- [CVE-2026-49057](https://cve.now/CVE-2026-49057.md): WordPress JobSearch plugin \<= 3.2.7 - Broken Access Control vulnerability (CVSS 7.5, EyeCix Technologies JobSearch)
- [CVE-2026-48869](https://cve.now/CVE-2026-48869.md): WordPress Enfold theme \<= 7.1.4 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Kriesi Enfold)
- [CVE-2026-40761](https://cve.now/CVE-2026-40761.md): WordPress Valeska theme \<= 1.2.2 - PHP Object Injection vulnerability (CVSS 8.1, Edge-Themes Valeska)
- [CVE-2026-40760](https://cve.now/CVE-2026-40760.md): WordPress Behold theme \<= 1.5 - PHP Object Injection vulnerability (CVSS 8.1, Edge-Themes Behold)
- [CVE-2026-40759](https://cve.now/CVE-2026-40759.md): WordPress Esmée theme \<= 1.4 - PHP Object Injection vulnerability (CVSS 8.1, Mikado-Themes Esmée)
- [CVE-2026-40758](https://cve.now/CVE-2026-40758.md): WordPress Léonie theme \<= 1.2.1 - PHP Object Injection vulnerability (CVSS 8.1, Elated-Themes Léonie)
- [CVE-2026-40755](https://cve.now/CVE-2026-40755.md): WordPress TechLink theme \<= 1.3 - PHP Object Injection vulnerability (CVSS 8.1, Mikado-Themes TechLink)
- [CVE-2026-40754](https://cve.now/CVE-2026-40754.md): WordPress Roisin theme \<= 1.4 - PHP Object Injection vulnerability (CVSS 8.1, Elated-Themes Roisin)
- [CVE-2026-40751](https://cve.now/CVE-2026-40751.md): WordPress Ashtanga theme \<= 1.2 - PHP Object Injection vulnerability (CVSS 8.1, Mikado-Themes Ashtanga)
- [CVE-2026-40739](https://cve.now/CVE-2026-40739.md): WordPress LuxeDrive theme \<= 1.4 - PHP Object Injection vulnerability (CVSS 8.1, Mikado-Themes LuxeDrive)
- [CVE-2026-40736](https://cve.now/CVE-2026-40736.md): WordPress Laurits theme \<= 1.5.1 - PHP Object Injection vulnerability (CVSS 8.1, Edge-Themes Laurits)
- [CVE-2026-39580](https://cve.now/CVE-2026-39580.md): WordPress Micdrop theme \<= 1.3.1 - PHP Object Injection vulnerability (CVSS 8.1, Select-Themes Micdrop)
- [CVE-2026-39578](https://cve.now/CVE-2026-39578.md): WordPress Valiance theme \<= 1.2 - PHP Object Injection vulnerability (CVSS 8.1, Elated-Themes Valiance)
- [CVE-2026-39577](https://cve.now/CVE-2026-39577.md): WordPress Playroom theme \<= 1.4.1 - PHP Object Injection vulnerability (CVSS 8.1, Elated-Themes Playroom)
- [CVE-2026-39568](https://cve.now/CVE-2026-39568.md): WordPress Mr. SEO theme \<= 2.0 - Local File Inclusion vulnerability (CVSS 8.1, Elated-Themes Mr. SEO)
- [CVE-2026-39567](https://cve.now/CVE-2026-39567.md): WordPress Santé theme \<= 1.5.1 - PHP Object Injection vulnerability (CVSS 8.1, Select-Themes Santé)
- [CVE-2026-39557](https://cve.now/CVE-2026-39557.md): WordPress NeoBeat theme \<= 1.7 - PHP Object Injection vulnerability (CVSS 8.1, Elated-Themes NeoBeat)
- [CVE-2026-39554](https://cve.now/CVE-2026-39554.md): WordPress Fidalgo theme \<= 1.2.2 - PHP Object Injection vulnerability (CVSS 8.1, Elated-Themes Fidalgo)
- [CVE-2026-39549](https://cve.now/CVE-2026-39549.md): WordPress Aperitif theme \<= 1.5 - Local File Inclusion vulnerability (CVSS 8.1, Elated-Themes Aperitif)
- [CVE-2026-39548](https://cve.now/CVE-2026-39548.md): WordPress MagOne theme \<= 9.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Sneeit MagOne)
- [CVE-2026-39547](https://cve.now/CVE-2026-39547.md): WordPress Getaway theme \< 1.8 - Local File Inclusion vulnerability (CVSS 8.1, Select-Themes Getaway)
- [CVE-2026-39539](https://cve.now/CVE-2026-39539.md): WordPress Alloggio - Hotel Booking theme \<= 2.1.2 - PHP Object Injection vulnerability (CVSS 8.1, Edge-Themes Alloggio - Hotel Booking)
- [CVE-2026-39529](https://cve.now/CVE-2026-39529.md): WordPress Elementra theme \<= 1.0.9 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Group Elementra)
- [CVE-2026-39522](https://cve.now/CVE-2026-39522.md): WordPress Solene theme \<= 3.4 - Local File Inclusion vulnerability (CVSS 8.1, Elated-Themes Solene)
- [CVE-2026-39446](https://cve.now/CVE-2026-39446.md): WordPress Kapee theme \< 1.7.0 - PHP Object Injection vulnerability (CVSS 8.1, PressLayouts Kapee)
- [CVE-2026-39443](https://cve.now/CVE-2026-39443.md): WordPress EmallShop theme \<= 2.4.21 - PHP Object Injection vulnerability (CVSS 8.1, PressLayouts EmallShop)
- [CVE-2026-39438](https://cve.now/CVE-2026-39438.md): WordPress ListingPro plugin \<= 2.9.10 - SQL Injection vulnerability (CVSS 9.3, Emraan Cheema ListingPro)
- [CVE-2026-39433](https://cve.now/CVE-2026-39433.md): WordPress WPAMS plugin \< 49.5.3 - Arbitrary Content Deletion vulnerability (CVSS 6.5, mojoomla WPAMS)
- [CVE-2026-34895](https://cve.now/CVE-2026-34895.md): WordPress Softlab Core plugin \< 1.2.11 - Local File Inclusion vulnerability (CVSS 8.1, WebGeniusLab Softlab Core)
- [CVE-2026-34894](https://cve.now/CVE-2026-34894.md): WordPress Integrio Core plugin \< 1.2.8 - Local File Inclusion vulnerability (CVSS 8.1, WebGeniusLab Integrio Core)
- [CVE-2026-34893](https://cve.now/CVE-2026-34893.md): WordPress Thegov Core plugin \< 2.0.23 - Local File Inclusion vulnerability (CVSS 8.1, WebGeniusLab Thegov Core)
- [CVE-2026-27429](https://cve.now/CVE-2026-27429.md): WordPress Nifty theme \<= 1.4.1 - PHP Object Injection vulnerability (CVSS 9.8, BoldThemes Nifty)
- [CVE-2026-27395](https://cve.now/CVE-2026-27395.md): WordPress Support Board plugin \< 3.8.9 - Privilege Escalation vulnerability (CVSS 9.8, Schiocco Support Board)
- [CVE-2026-12256](https://cve.now/CVE-2026-12256.md): WordPress Fusion Builder plugin \<= 3.15.3 - PHP Object Injection vulnerability (CVSS 8.8, ThemeFusion Fusion Builder)
- [CVE-2025-69178](https://cve.now/CVE-2025-69178.md): WordPress Truemag theme \<= 4.3.14.2 - Local File Inclusion vulnerability (CVSS 8.1, CactusThemes Truemag)
- [CVE-2025-69177](https://cve.now/CVE-2025-69177.md): WordPress Roneous theme \<= 2.1.5 - Local File Inclusion vulnerability (CVSS 8.1, THEMELOGI Roneous)
- [CVE-2025-69176](https://cve.now/CVE-2025-69176.md): WordPress ITactics theme \<= 1.0 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX ITactics)
- [CVE-2025-69168](https://cve.now/CVE-2025-69168.md): WordPress Spike theme \<= 1.2 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Spike)
- [CVE-2025-69167](https://cve.now/CVE-2025-69167.md): WordPress Eros theme \<= 1.3 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Eros)
- [CVE-2025-69165](https://cve.now/CVE-2025-69165.md): WordPress Choreo theme \<= 1.6 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Choreo)
- [CVE-2025-69163](https://cve.now/CVE-2025-69163.md): WordPress WineShop theme \<= 3.17 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX WineShop)
- [CVE-2025-69162](https://cve.now/CVE-2025-69162.md): WordPress Grecko theme \<= 5.17 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Grecko)
- [CVE-2025-69160](https://cve.now/CVE-2025-69160.md): WordPress Gita theme \<= 1.11 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Gita)
- [CVE-2025-69159](https://cve.now/CVE-2025-69159.md): WordPress Printo theme \<= 1.11 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Printo)
- [CVE-2025-69151](https://cve.now/CVE-2025-69151.md): WordPress Grand Car Rental theme \<= 3.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ThemeGoods Grand Car Rental)
- [CVE-2025-69150](https://cve.now/CVE-2025-69150.md): WordPress Medeus theme \<= 1.14 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Medeus)
- [CVE-2025-69149](https://cve.now/CVE-2025-69149.md): WordPress Top Dog theme \<= 1.0.5 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Top Dog)
- [CVE-2025-69147](https://cve.now/CVE-2025-69147.md): WordPress Putter theme \<= 1.17 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Putter)
- [CVE-2025-69146](https://cve.now/CVE-2025-69146.md): WordPress Dom theme \<= 1.24 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Dom)
- [CVE-2025-69143](https://cve.now/CVE-2025-69143.md): WordPress Mission theme \<= 1.22 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Mission)
- [CVE-2025-69142](https://cve.now/CVE-2025-69142.md): WordPress Abelle theme \<= 1.22 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Abelle)
- [CVE-2025-69141](https://cve.now/CVE-2025-69141.md): WordPress Kelly Young theme \<= 1.1.0 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Kelly Young)
- [CVE-2025-69139](https://cve.now/CVE-2025-69139.md): WordPress Car Zone theme \<= 3.7 - Arbitrary File Deletion vulnerability (CVSS 8.6, AivahThemes Car Zone)
- [CVE-2025-69137](https://cve.now/CVE-2025-69137.md): WordPress Genemy theme \<= 1.6.6 - Broken Access Control vulnerability (CVSS 6.5, Jthemes Genemy)
- [CVE-2025-69136](https://cve.now/CVE-2025-69136.md): WordPress Wanium theme \<= 1.9.8 - Local File Inclusion vulnerability (CVSS 8.1, THEMELOGI Wanium)
- [CVE-2025-69131](https://cve.now/CVE-2025-69131.md): WordPress WordPress & WooCommerce Scraper Plugin, Import Data from Any Site plugin \<= 1.0.7 - Arbitrary File Download vulnerability (CVSS 7.5, extendons WordPress & WooCommerce Scraper Plugin, Import Da…)
- [CVE-2025-69125](https://cve.now/CVE-2025-69125.md): WordPress Food Drop theme \<= 1.3 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Food Drop)
- [CVE-2025-69124](https://cve.now/CVE-2025-69124.md): WordPress Especio theme \<= 1.0 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Especio)
- [CVE-2025-69122](https://cve.now/CVE-2025-69122.md): WordPress SeaFood Company theme \<= 1.4 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX SeaFood Company)
- [CVE-2025-69121](https://cve.now/CVE-2025-69121.md): WordPress Deliciosa theme \<= 1.10.0 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Deliciosa)
- [CVE-2025-69119](https://cve.now/CVE-2025-69119.md): WordPress Corbesier theme \<= 1.15.0 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Corbesier)
- [CVE-2025-69118](https://cve.now/CVE-2025-69118.md): WordPress CopyPress theme \<= 1.4.5 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX CopyPress)
- [CVE-2025-69116](https://cve.now/CVE-2025-69116.md): WordPress Iona theme \<= 1.0.8 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Iona)
- [CVE-2025-69114](https://cve.now/CVE-2025-69114.md): WordPress MaxiNet theme \<= 1.2.10 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX MaxiNet)
- [CVE-2025-69113](https://cve.now/CVE-2025-69113.md): WordPress Nexio theme \<= 1.10.0 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Nexio)
- [CVE-2025-69112](https://cve.now/CVE-2025-69112.md): WordPress Planty theme \<= 1.14.0 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Planty)
- [CVE-2025-69109](https://cve.now/CVE-2025-69109.md): WordPress Raider Spirit theme \<= 1.1.2 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Raider Spirit)
- [CVE-2025-69108](https://cve.now/CVE-2025-69108.md): WordPress Hot Coffee theme \<= 1.7 - PHP Object Injection vulnerability (CVSS 9.8, ThemeREX Hot Coffee)
- [CVE-2025-69107](https://cve.now/CVE-2025-69107.md): WordPress Rosaleen theme \<= 2.8 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Rosaleen)
- [CVE-2025-69105](https://cve.now/CVE-2025-69105.md): WordPress Modernee theme \<= 1.6.0 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Modernee)
- [CVE-2025-69104](https://cve.now/CVE-2025-69104.md): WordPress Qreatix theme \<= 1.9.4 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, jkdevstudio Qreatix)
- [CVE-2025-69103](https://cve.now/CVE-2025-69103.md): WordPress Brikk theme \<= 3.0.0 - Arbitrary Content Deletion vulnerability (CVSS 7.5, Utillz Brikk)
- [CVE-2025-60085](https://cve.now/CVE-2025-60085.md): WordPress Learnify theme \<= 1.15.0 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Group Learnify)
- [CVE-2025-58924](https://cve.now/CVE-2025-58924.md): WordPress Geya theme \<= 1.15 - Local File Inclusion vulnerability (CVSS 8.1, ThemeREX Group Geya)
- [CVE-2026-54194](https://cve.now/CVE-2026-54194.md): WordPress Fusion Builder plugin \<= 3.15.4 - PHP Object Injection vulnerability (CVSS 9.8, ThemeFusion Fusion Builder)
- [CVE-2026-48294](https://cve.now/CVE-2026-48294.md): Adobe Acrobat PDF Extension (Chrome) versions 26.5.2.2 and earlier are affected by a UXSS-class cross-origin data disclosure vulnerability. (CVSS 7.4, Adobe Acrobat PDF Extension)
- [CVE-2026-12348](https://cve.now/CVE-2026-12348.md): Address Bar Spoofing in Arc Search for Android (window.open race condition) (CVSS 7.4, The Browser Company of New York\` Arc Search)
- [CVE-2026-48776](https://cve.now/CVE-2026-48776.md): LangGraph SDK has unsafe URL path construction (CVSS 4.2, langchain-ai · langgraph-sdk +1)
- [CVE-2026-46979](https://cve.now/CVE-2026-46979.md): Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Integration and Interfaces). (CVSS 6.5, Oracle PeopleSoft Enterprise CS Campus Community)
- [CVE-2026-46978](https://cve.now/CVE-2026-46978.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Remote Administration Daemon). (CVSS 10.0, Oracle Solaris)
- [CVE-2026-46977](https://cve.now/CVE-2026-46977.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). (CVSS 3.2, Oracle VM VirtualBox)
- [CVE-2026-46976](https://cve.now/CVE-2026-46976.md): Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Public Sector Payroll)
- [CVE-2026-46974](https://cve.now/CVE-2026-46974.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.5, Oracle VM VirtualBox)
- [CVE-2026-46973](https://cve.now/CVE-2026-46973.md): Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Outsourced Mfg for Discrete Industries)
- [CVE-2026-46972](https://cve.now/CVE-2026-46972.md): Vulnerability in the Oracle Outsourced Mfg for Discrete Industries product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Outsourced Mfg for Discrete Industries)
- [CVE-2026-46971](https://cve.now/CVE-2026-46971.md): Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.5, Oracle HR Intelligence)
- [CVE-2026-46970](https://cve.now/CVE-2026-46970.md): Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle HR Intelligence)
- [CVE-2026-46969](https://cve.now/CVE-2026-46969.md): Vulnerability in the Oracle Financials for EMEA product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Financials for EMEA)
- [CVE-2026-46967](https://cve.now/CVE-2026-46967.md): Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). (CVSS 8.8, Oracle Public Sector Financials)
- [CVE-2026-46966](https://cve.now/CVE-2026-46966.md): Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). (CVSS 7.5, Oracle Universal Work Queue)
- [CVE-2026-46965](https://cve.now/CVE-2026-46965.md): Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). (CVSS 8.8, Oracle Universal Work Queue)
- [CVE-2026-46964](https://cve.now/CVE-2026-46964.md): Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). (CVSS 9.9, Oracle Universal Work Queue)
- [CVE-2026-46963](https://cve.now/CVE-2026-46963.md): Vulnerability in the Oracle Universal Work Queue product of Oracle E-Business Suite (component: Work Provider Site Level Administration). (CVSS 9.9, Oracle Universal Work Queue)
- [CVE-2026-46962](https://cve.now/CVE-2026-46962.md): Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Project Portfolio Analysis)
- [CVE-2026-46961](https://cve.now/CVE-2026-46961.md): Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Project Portfolio Analysis)
- [CVE-2026-46960](https://cve.now/CVE-2026-46960.md): Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Project Portfolio Analysis)
- [CVE-2026-46959](https://cve.now/CVE-2026-46959.md): Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.5, Oracle Subledger Accounting)
- [CVE-2026-46958](https://cve.now/CVE-2026-46958.md): Vulnerability in the Oracle Subledger Accounting product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.5, Oracle Subledger Accounting)
- [CVE-2026-46957](https://cve.now/CVE-2026-46957.md): Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.5, Oracle iSupplier Portal)
- [CVE-2026-46956](https://cve.now/CVE-2026-46956.md): Vulnerability in the Oracle Property Manager product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Property Manager)
- [CVE-2026-46955](https://cve.now/CVE-2026-46955.md): Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Person). (CVSS 7.5, Oracle Human Resources)
- [CVE-2026-46953](https://cve.now/CVE-2026-46953.md): Vulnerability in the Oracle HRMS (UK) product of Oracle E-Business Suite (component: UK Payroll). (CVSS 7.2, Oracle HRMS)
- [CVE-2026-46952](https://cve.now/CVE-2026-46952.md): Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Quality)
- [CVE-2026-46951](https://cve.now/CVE-2026-46951.md): Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Quality)
- [CVE-2026-46950](https://cve.now/CVE-2026-46950.md): Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Advanced Outbound Telephony)
- [CVE-2026-46949](https://cve.now/CVE-2026-46949.md): Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Internal Operations). (CVSS 9.1, Oracle Advanced Outbound Telephony)
- [CVE-2026-46947](https://cve.now/CVE-2026-46947.md): Vulnerability in the Oracle Advanced Outbound Telephony product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Advanced Outbound Telephony)
- [CVE-2026-46946](https://cve.now/CVE-2026-46946.md): Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). (CVSS 9.1, Oracle iSupport)
- [CVE-2026-46945](https://cve.now/CVE-2026-46945.md): Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). (CVSS 9.1, Oracle iSupport)
- [CVE-2026-46944](https://cve.now/CVE-2026-46944.md): Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). (CVSS 9.1, Oracle iSupport)
- [CVE-2026-46942](https://cve.now/CVE-2026-46942.md): Vulnerability in the Oracle Process Manufacturing Process Planning product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Process Manufacturing Process Planning)
- [CVE-2026-46940](https://cve.now/CVE-2026-46940.md): Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). (CVSS 8.8, Oracle Cost Management)
- [CVE-2026-46939](https://cve.now/CVE-2026-46939.md): Vulnerability in the Oracle Configure to Order product of Oracle E-Business Suite (component: Supply to Order Workbench). (CVSS 8.1, Oracle Configure to Order)
- [CVE-2026-46938](https://cve.now/CVE-2026-46938.md): Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). (CVSS 7.2, Oracle Cost Management)
- [CVE-2026-46937](https://cve.now/CVE-2026-46937.md): Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). (CVSS 8.8, Oracle iSetup)
- [CVE-2026-46935](https://cve.now/CVE-2026-46935.md): Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.5, Oracle Complex Maintenance, Repair and Overhaul)
- [CVE-2026-46934](https://cve.now/CVE-2026-46934.md): Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.5, Oracle Complex Maintenance, Repair and Overhaul)
- [CVE-2026-46933](https://cve.now/CVE-2026-46933.md): Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Internal Operations). (CVSS 9.9, Oracle Applications Manager)
- [CVE-2026-46932](https://cve.now/CVE-2026-46932.md): Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle Enterprise Asset Management)
- [CVE-2026-46931](https://cve.now/CVE-2026-46931.md): Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Enterprise Asset Management)
- [CVE-2026-46930](https://cve.now/CVE-2026-46930.md): Vulnerability in the Oracle In-Memory Cost Management for Discrete Industries product of Oracle E-Business Suite (component: Internal Operat (CVSS 9.1, Oracle In-Memory Cost Management for Discrete Industries)
- [CVE-2026-46929](https://cve.now/CVE-2026-46929.md): Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). (CVSS 8.8, Oracle Cost Management)
- [CVE-2026-46928](https://cve.now/CVE-2026-46928.md): Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Spares Management)
- [CVE-2026-46927](https://cve.now/CVE-2026-46927.md): Vulnerability in the Oracle Receivables product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Receivables)
- [CVE-2026-46926](https://cve.now/CVE-2026-46926.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 8.8, Oracle Siebel CRM Cloud Applications)
- [CVE-2026-46925](https://cve.now/CVE-2026-46925.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 8.3, Oracle Siebel CRM Cloud Applications)
- [CVE-2026-46922](https://cve.now/CVE-2026-46922.md): Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle HR Intelligence)
- [CVE-2026-46921](https://cve.now/CVE-2026-46921.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 8.8, Oracle Siebel CRM Cloud Applications)
- [CVE-2026-46920](https://cve.now/CVE-2026-46920.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 8.1, Oracle Siebel CRM Cloud Applications)
- [CVE-2026-46919](https://cve.now/CVE-2026-46919.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 9.8, Oracle Siebel CRM Cloud Applications)
- [CVE-2026-46918](https://cve.now/CVE-2026-46918.md): Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Internal Operations). (CVSS 9.9, Oracle Process Manufacturing Product Development)
- [CVE-2026-46916](https://cve.now/CVE-2026-46916.md): Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Management Spec (CVSS 8.8, Oracle Process Manufacturing Product Development)
- [CVE-2026-46915](https://cve.now/CVE-2026-46915.md): Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Production). (CVSS 8.5, Oracle Complex Maintenance, Repair and Overhaul)
- [CVE-2026-46914](https://cve.now/CVE-2026-46914.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). (CVSS 7.1, Oracle Solaris)
- [CVE-2026-46913](https://cve.now/CVE-2026-46913.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). (CVSS 9.3, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2026-46912](https://cve.now/CVE-2026-46912.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security). (CVSS 9.3, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2026-46911](https://cve.now/CVE-2026-46911.md): Vulnerability in the JD Edwards EnterpriseOne Project Costing product of Oracle JD Edwards (component: Job Costing). (CVSS 9.6, Oracle JD Edwards EnterpriseOne Project Costing)
- [CVE-2026-46910](https://cve.now/CVE-2026-46910.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). (CVSS 9.1, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2026-46909](https://cve.now/CVE-2026-46909.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). (CVSS 9.8, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2026-46908](https://cve.now/CVE-2026-46908.md): Vulnerability in the JD Edwards EnterpriseOne Accounts Payable product of Oracle JD Edwards (component: Accounts Payable). (CVSS 9.9, Oracle JD Edwards EnterpriseOne Accounts Payable)
- [CVE-2026-46907](https://cve.now/CVE-2026-46907.md): Vulnerability in the JD Edwards EnterpriseOne Order Promising product of Oracle JD Edwards (component: Order Promising Integration). (CVSS 9.9, Oracle JD Edwards EnterpriseOne Order Promising)
- [CVE-2026-46906](https://cve.now/CVE-2026-46906.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). (CVSS 9.6, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2026-46905](https://cve.now/CVE-2026-46905.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime Security). (CVSS 9.8, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2026-46904](https://cve.now/CVE-2026-46904.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). (CVSS 9.8, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2026-46903](https://cve.now/CVE-2026-46903.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infrastructure Security). (CVSS 8.8, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2026-46902](https://cve.now/CVE-2026-46902.md): Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). (CVSS 9.8, Oracle Enterprise Command Center Framework)
- [CVE-2026-46901](https://cve.now/CVE-2026-46901.md): Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). (CVSS 9.9, Oracle Enterprise Command Center Framework)
- [CVE-2026-46900](https://cve.now/CVE-2026-46900.md): Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). (CVSS 9.9, Oracle Enterprise Command Center Framework)
- [CVE-2026-46899](https://cve.now/CVE-2026-46899.md): Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). (CVSS 9.6, Oracle Enterprise Command Center Framework)
- [CVE-2026-46898](https://cve.now/CVE-2026-46898.md): Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). (CVSS 8.1, Oracle Enterprise Command Center Framework)
- [CVE-2026-46897](https://cve.now/CVE-2026-46897.md): Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). (CVSS 9.9, Oracle Enterprise Command Center Framework)
- [CVE-2026-46896](https://cve.now/CVE-2026-46896.md): Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). (CVSS 9.1, Oracle Enterprise Command Center Framework)
- [CVE-2026-46895](https://cve.now/CVE-2026-46895.md): Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: Core). (CVSS 9.9, Oracle Enterprise Command Center Framework)
- [CVE-2026-46894](https://cve.now/CVE-2026-46894.md): Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). (CVSS 8.0, Oracle iSupplier Portal)
- [CVE-2026-46893](https://cve.now/CVE-2026-46893.md): Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards (component: E1 Foundation). (CVSS 9.9, Oracle JD Edwards EnterpriseOne General Ledger)
- [CVE-2026-46892](https://cve.now/CVE-2026-46892.md): Vulnerability in the JD Edwards EnterpriseOne Human Resources Management product of Oracle JD Edwards (component: Human Resources). (CVSS 9.1, Oracle JD Edwards EnterpriseOne Human Resources Management)
- [CVE-2026-46891](https://cve.now/CVE-2026-46891.md): Vulnerability in the JD Edwards EnterpriseOne Accounts Payable product of Oracle JD Edwards (component: Accounts Payable). (CVSS 8.1, Oracle JD Edwards EnterpriseOne Accounts Payable)
- [CVE-2026-46890](https://cve.now/CVE-2026-46890.md): Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). (CVSS 9.8, Oracle Siebel Apps - Marketing)
- [CVE-2026-46889](https://cve.now/CVE-2026-46889.md): Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). (CVSS 9.8, Oracle Siebel Apps - Marketing)
- [CVE-2026-46888](https://cve.now/CVE-2026-46888.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Database Upgrade). (CVSS 7.8, Oracle Siebel CRM Deployment)
- [CVE-2026-46887](https://cve.now/CVE-2026-46887.md): Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). (CVSS 9.8, Oracle Siebel Apps - Marketing)
- [CVE-2026-46886](https://cve.now/CVE-2026-46886.md): Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). (CVSS 8.8, Oracle Siebel Apps - Marketing)
- [CVE-2026-46885](https://cve.now/CVE-2026-46885.md): Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). (CVSS 8.8, Oracle Siebel CRM Integration)
- [CVE-2026-46884](https://cve.now/CVE-2026-46884.md): Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). (CVSS 9.8, Oracle Siebel Apps - Marketing)
- [CVE-2026-46883](https://cve.now/CVE-2026-46883.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). (CVSS 9.8, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2026-46882](https://cve.now/CVE-2026-46882.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). (CVSS 9.8, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2026-46881](https://cve.now/CVE-2026-46881.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). (CVSS 9.8, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2026-46880](https://cve.now/CVE-2026-46880.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). (CVSS 9.8, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2026-46879](https://cve.now/CVE-2026-46879.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). (CVSS 9.8, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2026-46878](https://cve.now/CVE-2026-46878.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure Security). (CVSS 9.8, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2026-46877](https://cve.now/CVE-2026-46877.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2026-46875](https://cve.now/CVE-2026-46875.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Deployment Library). (CVSS 9.1, Oracle Enterprise Manager Base Platform)
- [CVE-2026-46874](https://cve.now/CVE-2026-46874.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 3.2, Oracle VM VirtualBox)
- [CVE-2026-46873](https://cve.now/CVE-2026-46873.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). (CVSS 7.5, Oracle VM VirtualBox)
- [CVE-2026-46872](https://cve.now/CVE-2026-46872.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Install). (CVSS 9.0, Oracle Enterprise Manager Base Platform)
- [CVE-2026-46871](https://cve.now/CVE-2026-46871.md): Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). (CVSS 6.5, Oracle MySQL Shell)
- [CVE-2026-46870](https://cve.now/CVE-2026-46870.md): Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). (CVSS 8.5, Oracle MySQL Shell)
- [CVE-2026-46869](https://cve.now/CVE-2026-46869.md): Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Dump and Load). (CVSS 6.5, Oracle MySQL Shell)
- [CVE-2026-46868](https://cve.now/CVE-2026-46868.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). (CVSS 7.2, Oracle Enterprise Manager Base Platform)
- [CVE-2026-46867](https://cve.now/CVE-2026-46867.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). (CVSS 7.2, Oracle Enterprise Manager Base Platform)
- [CVE-2026-46866](https://cve.now/CVE-2026-46866.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). (CVSS 8.2, Oracle Enterprise Manager Base Platform)
- [CVE-2026-46865](https://cve.now/CVE-2026-46865.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). (CVSS 8.2, Oracle Enterprise Manager Base Platform)
- [CVE-2026-46864](https://cve.now/CVE-2026-46864.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). (CVSS 8.8, Oracle Enterprise Manager Base Platform)
- [CVE-2026-46863](https://cve.now/CVE-2026-46863.md): Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling). (CVSS 7.5, Oracle MySQL Server · Oracle MySQL Cluster)
- [CVE-2026-46862](https://cve.now/CVE-2026-46862.md): Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). (CVSS 7.5, Oracle MySQL Router)
- [CVE-2026-46861](https://cve.now/CVE-2026-46861.md): Vulnerability in the MySQL NDB Cluster product of Oracle MySQL (component: Cluster: NDB Operator). (CVSS 9.6, Oracle MySQL NDB Cluster)
- [CVE-2026-46860](https://cve.now/CVE-2026-46860.md): Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). (CVSS 9.8, Oracle MySQL Router)
- [CVE-2026-46859](https://cve.now/CVE-2026-46859.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). (CVSS 9.8, Oracle Agile PLM)
- [CVE-2026-46858](https://cve.now/CVE-2026-46858.md): Vulnerability in the APM - Application Performance Management product of Oracle Enterprise Manager (component: JADM, JVM Diagnostics). (CVSS 9.1, Oracle APM - Application Performance Management)
- [CVE-2026-46857](https://cve.now/CVE-2026-46857.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Oracle Management Service). (CVSS 9.8, Oracle Enterprise Manager Base Platform)
- [CVE-2026-46856](https://cve.now/CVE-2026-46856.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). (CVSS 9.6, Oracle Enterprise Manager Base Platform)
- [CVE-2026-46855](https://cve.now/CVE-2026-46855.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). (CVSS 9.9, Oracle Enterprise Manager Base Platform)
- [CVE-2026-46854](https://cve.now/CVE-2026-46854.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Target Management). (CVSS 9.9, Oracle Enterprise Manager Base Platform)
- [CVE-2026-46853](https://cve.now/CVE-2026-46853.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). (CVSS 9.6, Oracle Enterprise Manager Base Platform)
- [CVE-2026-46852](https://cve.now/CVE-2026-46852.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Metadata Plugin). (CVSS 9.9, Oracle Enterprise Manager Base Platform)
- [CVE-2026-46851](https://cve.now/CVE-2026-46851.md): Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft (component: Security). (CVSS 8.1, Oracle PeopleSoft Enterprise CS Campus Community)
- [CVE-2026-46850](https://cve.now/CVE-2026-46850.md): Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). (CVSS 9.9, Oracle MySQL Shell)
- [CVE-2026-46849](https://cve.now/CVE-2026-46849.md): Vulnerability in the PeopleSoft Enterprise CS Student Financials product of Oracle PeopleSoft (component: Other). (CVSS 8.1, Oracle PeopleSoft Enterprise CS Student Financials)
- [CVE-2026-46848](https://cve.now/CVE-2026-46848.md): Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). (CVSS 7.9, Oracle WebLogic Server)
- [CVE-2026-46847](https://cve.now/CVE-2026-46847.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 9.9, Oracle WebCenter Portal)
- [CVE-2026-46846](https://cve.now/CVE-2026-46846.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). (CVSS 10.0, Oracle WebCenter Portal)
- [CVE-2026-46845](https://cve.now/CVE-2026-46845.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). (CVSS 9.8, Oracle WebCenter Portal)
- [CVE-2026-46844](https://cve.now/CVE-2026-46844.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). (CVSS 9.9, Oracle WebCenter Portal)
- [CVE-2026-46838](https://cve.now/CVE-2026-46838.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). (CVSS 9.9, Oracle WebCenter Portal)
- [CVE-2026-46832](https://cve.now/CVE-2026-46832.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Discovery Framework). (CVSS 9.9, Oracle Enterprise Manager Base Platform)
- [CVE-2026-46825](https://cve.now/CVE-2026-46825.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2026-46816](https://cve.now/CVE-2026-46816.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). (CVSS 3.2, Oracle VM VirtualBox)
- [CVE-2026-46815](https://cve.now/CVE-2026-46815.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). (CVSS 3.2, Oracle VM VirtualBox)
- [CVE-2026-46814](https://cve.now/CVE-2026-46814.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). (CVSS 9.9, Oracle WebCenter Portal)
- [CVE-2026-46813](https://cve.now/CVE-2026-46813.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 9.8, Oracle WebCenter Content)
- [CVE-2026-46812](https://cve.now/CVE-2026-46812.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 6.1, Oracle Access Manager)
- [CVE-2026-46810](https://cve.now/CVE-2026-46810.md): Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: End User Self Service). (CVSS 6.5, Oracle Identity Manager)
- [CVE-2026-46809](https://cve.now/CVE-2026-46809.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 9.1, Oracle WebCenter Sites)
- [CVE-2026-46808](https://cve.now/CVE-2026-46808.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 8.7, Oracle WebCenter Content)
- [CVE-2026-46807](https://cve.now/CVE-2026-46807.md): Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). (CVSS 9.8, Oracle Identity Manager)
- [CVE-2026-46806](https://cve.now/CVE-2026-46806.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 8.2, Oracle WebCenter Content)
- [CVE-2026-46805](https://cve.now/CVE-2026-46805.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 9.3, Oracle WebCenter Content)
- [CVE-2026-46804](https://cve.now/CVE-2026-46804.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 8.7, Oracle WebCenter Content)
- [CVE-2026-46803](https://cve.now/CVE-2026-46803.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). (CVSS 10.0, Oracle WebCenter Portal)
- [CVE-2026-46802](https://cve.now/CVE-2026-46802.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). (CVSS 9.9, Oracle WebCenter Portal)
- [CVE-2026-46801](https://cve.now/CVE-2026-46801.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 9.8, Oracle WebCenter Sites)
- [CVE-2026-46800](https://cve.now/CVE-2026-46800.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 10.0, Oracle WebCenter Sites)
- [CVE-2026-46799](https://cve.now/CVE-2026-46799.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 9.8, Oracle WebCenter Sites)
- [CVE-2026-46798](https://cve.now/CVE-2026-46798.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 10.0, Oracle WebCenter Sites)
- [CVE-2026-46797](https://cve.now/CVE-2026-46797.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 9.8, Oracle WebCenter Sites)
- [CVE-2026-46796](https://cve.now/CVE-2026-46796.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 8.0, Oracle WebCenter Sites)
- [CVE-2026-46795](https://cve.now/CVE-2026-46795.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 9.3, Oracle WebCenter Content)
- [CVE-2026-46794](https://cve.now/CVE-2026-46794.md): Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Generic Unix Connector). (CVSS 9.9, Oracle Identity Manager Connector)
- [CVE-2026-46793](https://cve.now/CVE-2026-46793.md): Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Database User). (CVSS 9.9, Oracle Identity Manager Connector)
- [CVE-2026-46792](https://cve.now/CVE-2026-46792.md): Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Generic Unix Connector). (CVSS 9.9, Oracle Identity Manager Connector)
- [CVE-2026-46791](https://cve.now/CVE-2026-46791.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 7.5, Oracle WebCenter Content)
- [CVE-2026-46790](https://cve.now/CVE-2026-46790.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 5.3, Oracle WebCenter Content)
- [CVE-2026-46789](https://cve.now/CVE-2026-46789.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 9.6, Oracle WebCenter Content)
- [CVE-2026-46788](https://cve.now/CVE-2026-46788.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 8.4, Oracle WebCenter Content)
- [CVE-2026-46787](https://cve.now/CVE-2026-46787.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 8.0, Oracle WebCenter Content)
- [CVE-2026-46786](https://cve.now/CVE-2026-46786.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 9.6, Oracle WebCenter Content)
- [CVE-2026-46785](https://cve.now/CVE-2026-46785.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 9.3, Oracle WebCenter Content)
- [CVE-2026-46784](https://cve.now/CVE-2026-46784.md): Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). (CVSS 9.1, Oracle WebCenter Content: Imaging)
- [CVE-2026-46783](https://cve.now/CVE-2026-46783.md): Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle WebCenter Content: Imaging)
- [CVE-2026-46782](https://cve.now/CVE-2026-46782.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 9.9, Oracle WebCenter Enterprise Capture)
- [CVE-2026-46781](https://cve.now/CVE-2026-46781.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 10.0, Oracle WebCenter Enterprise Capture)
- [CVE-2026-46780](https://cve.now/CVE-2026-46780.md): Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). (CVSS 8.8, Oracle WebCenter Content: Imaging)
- [CVE-2026-46779](https://cve.now/CVE-2026-46779.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 9.9, Oracle WebCenter Enterprise Capture)
- [CVE-2026-46778](https://cve.now/CVE-2026-46778.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 10.0, Oracle WebCenter Enterprise Capture)
- [CVE-2026-46777](https://cve.now/CVE-2026-46777.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 9.1, Oracle WebCenter Content)
- [CVE-2026-46776](https://cve.now/CVE-2026-46776.md): Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). (CVSS 8.6, Oracle Unified Directory)
- [CVE-2026-46774](https://cve.now/CVE-2026-46774.md): Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). (CVSS 9.8, Oracle Unified Directory)
- [CVE-2026-46773](https://cve.now/CVE-2026-46773.md): Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core). (CVSS 9.8, Oracle Unified Directory)
- [CVE-2026-46772](https://cve.now/CVE-2026-46772.md): Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). (CVSS 4.7, Oracle Application Development Framework)
- [CVE-2026-46771](https://cve.now/CVE-2026-46771.md): Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: Java Business Objects). (CVSS 4.1, Oracle Application Development Framework)
- [CVE-2026-46770](https://cve.now/CVE-2026-46770.md): Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: Security Framework). (CVSS 6.1, Oracle Application Development Framework)
- [CVE-2026-46769](https://cve.now/CVE-2026-46769.md): Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Shared Components). (CVSS 7.2, Oracle Application Development Framework)
- [CVE-2026-46768](https://cve.now/CVE-2026-46768.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2026-46767](https://cve.now/CVE-2026-46767.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). (CVSS 9.9, Oracle WebCenter Portal)
- [CVE-2026-46766](https://cve.now/CVE-2026-46766.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 9.8, Oracle WebCenter Content)
- [CVE-2026-46765](https://cve.now/CVE-2026-46765.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). (CVSS 9.9, Oracle WebCenter Portal)
- [CVE-2026-35327](https://cve.now/CVE-2026-35327.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 7.6, Oracle WebCenter Content)
- [CVE-2026-35326](https://cve.now/CVE-2026-35326.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 7.2, Oracle WebCenter Content)
- [CVE-2026-35325](https://cve.now/CVE-2026-35325.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 8.8, Oracle WebCenter Content)
- [CVE-2026-35324](https://cve.now/CVE-2026-35324.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 8.8, Oracle WebCenter Content)
- [CVE-2026-35323](https://cve.now/CVE-2026-35323.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 9.9, Oracle WebCenter Content)
- [CVE-2026-35322](https://cve.now/CVE-2026-35322.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 8.8, Oracle WebCenter Content)
- [CVE-2026-35321](https://cve.now/CVE-2026-35321.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 9.9, Oracle WebCenter Content)
- [CVE-2026-35320](https://cve.now/CVE-2026-35320.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 9.0, Oracle WebCenter Content)
- [CVE-2026-35319](https://cve.now/CVE-2026-35319.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 9.8, Oracle WebCenter Content)
- [CVE-2026-35318](https://cve.now/CVE-2026-35318.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 8.8, Oracle WebCenter Sites)
- [CVE-2026-35317](https://cve.now/CVE-2026-35317.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 8.8, Oracle WebCenter Content)
- [CVE-2026-35316](https://cve.now/CVE-2026-35316.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 9.9, Oracle WebCenter Content)
- [CVE-2026-35315](https://cve.now/CVE-2026-35315.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 8.8, Oracle WebCenter Content)
- [CVE-2026-35314](https://cve.now/CVE-2026-35314.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Web Server Plugin). (CVSS 7.3, Oracle Access Manager)
- [CVE-2026-35313](https://cve.now/CVE-2026-35313.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.9, Oracle Access Manager)
- [CVE-2026-35312](https://cve.now/CVE-2026-35312.md): Vulnerability in the Oracle Virtual Directory product of Oracle Fusion Middleware (component: Virtual Directory Server). (CVSS 9.8, Oracle Virtual Directory)
- [CVE-2026-35311](https://cve.now/CVE-2026-35311.md): Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 8.8, Oracle WebLogic Server)
- [CVE-2026-35310](https://cve.now/CVE-2026-35310.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle Coherence)
- [CVE-2026-35309](https://cve.now/CVE-2026-35309.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). (CVSS 9.8, Oracle Coherence)
- [CVE-2026-35308](https://cve.now/CVE-2026-35308.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). (CVSS 10.0, Oracle Coherence)
- [CVE-2026-35307](https://cve.now/CVE-2026-35307.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 10.0, Oracle Coherence)
- [CVE-2026-35306](https://cve.now/CVE-2026-35306.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). (CVSS 9.3, Oracle Coherence)
- [CVE-2026-35305](https://cve.now/CVE-2026-35305.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Centralized Third Party Jars). (CVSS 9.3, Oracle Coherence)
- [CVE-2026-35304](https://cve.now/CVE-2026-35304.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle Coherence)
- [CVE-2026-35303](https://cve.now/CVE-2026-35303.md): Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). (CVSS 8.8, Oracle WebLogic Server)
- [CVE-2026-35302](https://cve.now/CVE-2026-35302.md): Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). (CVSS 8.3, Oracle WebLogic Server)
- [CVE-2026-35301](https://cve.now/CVE-2026-35301.md): Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). (CVSS 10.0, Oracle WebLogic Server)
- [CVE-2026-35300](https://cve.now/CVE-2026-35300.md): Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle WebLogic Server)
- [CVE-2026-35299](https://cve.now/CVE-2026-35299.md): Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). (CVSS 8.8, Oracle WebLogic Server)
- [CVE-2026-35298](https://cve.now/CVE-2026-35298.md): Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 9.1, Oracle WebLogic Server)
- [CVE-2026-35296](https://cve.now/CVE-2026-35296.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 9.8, Oracle WebCenter Sites)
- [CVE-2026-35295](https://cve.now/CVE-2026-35295.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 7.5, Oracle WebCenter Sites)
- [CVE-2026-35294](https://cve.now/CVE-2026-35294.md): Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Mainframe Connectors). (CVSS 9.9, Oracle Identity Manager Connector)
- [CVE-2026-35293](https://cve.now/CVE-2026-35293.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 9.8, Oracle WebCenter Sites)
- [CVE-2026-35292](https://cve.now/CVE-2026-35292.md): Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). (CVSS 10.0, Oracle WebLogic Server)
- [CVE-2026-35291](https://cve.now/CVE-2026-35291.md): Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). (CVSS 6.6, Oracle WebLogic Server)
- [CVE-2026-35289](https://cve.now/CVE-2026-35289.md): Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). (CVSS 8.1, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2026-35288](https://cve.now/CVE-2026-35288.md): Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). (CVSS 8.2, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2026-35286](https://cve.now/CVE-2026-35286.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 9.8, Oracle WebCenter Content)
- [CVE-2026-35285](https://cve.now/CVE-2026-35285.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 9.9, Oracle WebCenter Enterprise Capture)
- [CVE-2026-35284](https://cve.now/CVE-2026-35284.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 9.9, Oracle WebCenter Enterprise Capture)
- [CVE-2026-35283](https://cve.now/CVE-2026-35283.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 9.9, Oracle WebCenter Enterprise Capture)
- [CVE-2026-35282](https://cve.now/CVE-2026-35282.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 9.9, Oracle WebCenter Enterprise Capture)
- [CVE-2026-35281](https://cve.now/CVE-2026-35281.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 9.9, Oracle WebCenter Enterprise Capture)
- [CVE-2026-35280](https://cve.now/CVE-2026-35280.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 9.9, Oracle WebCenter Enterprise Capture)
- [CVE-2026-35279](https://cve.now/CVE-2026-35279.md): Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Performance Monitor). (CVSS 8.1, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2026-35278](https://cve.now/CVE-2026-35278.md): Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Performance Monitor). (CVSS 9.8, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2026-35276](https://cve.now/CVE-2026-35276.md): Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Application Server). (CVSS 8.1, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2026-35275](https://cve.now/CVE-2026-35275.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Shared Folders). (CVSS 7.5, Oracle VM VirtualBox)
- [CVE-2026-35274](https://cve.now/CVE-2026-35274.md): Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). (CVSS 8.2, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2026-35272](https://cve.now/CVE-2026-35272.md): Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). (CVSS 8.4, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2026-35271](https://cve.now/CVE-2026-35271.md): Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Weblogic). (CVSS 8.7, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2026-35270](https://cve.now/CVE-2026-35270.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 9.1, Oracle WebCenter Content)
- [CVE-2026-35269](https://cve.now/CVE-2026-35269.md): Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). (CVSS 7.5, Oracle Identity Manager)
- [CVE-2026-35268](https://cve.now/CVE-2026-35268.md): Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Core). (CVSS 9.9, Oracle Identity Manager)
- [CVE-2026-35267](https://cve.now/CVE-2026-35267.md): Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: REST WebServices). (CVSS 8.8, Oracle Identity Manager)
- [CVE-2026-35265](https://cve.now/CVE-2026-35265.md): Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Security). (CVSS 8.8, Oracle Identity Manager)
- [CVE-2026-35263](https://cve.now/CVE-2026-35263.md): Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 9.9, Oracle WebLogic Server)
- [CVE-2026-35262](https://cve.now/CVE-2026-35262.md): Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Market Place). (CVSS 8.3, Oracle Data Integrator)
- [CVE-2026-35261](https://cve.now/CVE-2026-35261.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 6.5, Oracle Access Manager)
- [CVE-2026-35259](https://cve.now/CVE-2026-35259.md): Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). (CVSS 8.8, Oracle WebLogic Server)
- [CVE-2026-35258](https://cve.now/CVE-2026-35258.md): Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). (CVSS 8.7, Oracle WebLogic Server)
- [CVE-2026-0165](https://cve.now/CVE-2026-0165.md): In several functions of the RTCP packet decoder, there is a possible out-of-bounds read due to a missing bounds check. (CVSS 6.5, Google Android)
- [CVE-2026-0164](https://cve.now/CVE-2026-0164.md): In Modem, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, Google Android)
- [CVE-2026-0162](https://cve.now/CVE-2026-0162.md): In ParsePayloads of AudioSdpParser.cpp, there is a possible memory corruption due to type confusion. (CVSS 8.8, Google Android)
- [CVE-2026-0161](https://cve.now/CVE-2026-0161.md): In numberOfReportBlocks of RtpSession.cpp, there is a possible out of bounds write due to an integer overflow. (CVSS 8.8, Google Android)
- [CVE-2026-0160](https://cve.now/CVE-2026-0160.md): In TextRtpPayloadDecoderNode::DecodeT140 of TextRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to a missing bounds c (CVSS 8.8, Google Android)
- [CVE-2026-0158](https://cve.now/CVE-2026-0158.md): In Camera, there is a possible unauthorized way to access photos due to a missing permission check. (CVSS 4.0, Google Android)
- [CVE-2026-0157](https://cve.now/CVE-2026-0157.md): In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check. (CVSS 4.3, Google Android)
- [CVE-2026-0156](https://cve.now/CVE-2026-0156.md): In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. (CVSS 7.5, Google Android)
- [CVE-2026-0155](https://cve.now/CVE-2026-0155.md): In ImsMediaBitReader::ReadByteBuffer, there is a possible OOB read due to a missing bounds check. (CVSS 5.3, Google Android)
- [CVE-2026-0154](https://cve.now/CVE-2026-0154.md): In Modem, there is a possible way to trigger a modem crash during a SIP REFER request due to memory corruption. (CVSS 8.8, Google Android)
- [CVE-2026-0153](https://cve.now/CVE-2026-0153.md): In Write of msg\_to\_host\_buffer.cc, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, Google Android)
- [CVE-2026-0152](https://cve.now/CVE-2026-0152.md): In OSMMapPMRGeneric of pmr\_os.c, there is a possible way to leverage a system call to system call to maliciously expand the VMA out of bound (CVSS 7.8, Google Android)
- [CVE-2026-0151](https://cve.now/CVE-2026-0151.md): In IntfGraphCreate of intfgraph.c, there is a possible out of bounds write due to an integer overflow. (CVSS 8.8, Google Android)
- [CVE-2026-0150](https://cve.now/CVE-2026-0150.md): In ExecuteGraph command handler of EdgeTPU firmware, there is a possible out of bounds write due to an integer overflow. (CVSS 7.8, Google Android)
- [CVE-2026-0149](https://cve.now/CVE-2026-0149.md): In RtpSession::rtpSendRtcpPacket, there is a possible OOB write due to a heap buffer overflow. (CVSS 8.8, Google Android)
- [CVE-2026-0148](https://cve.now/CVE-2026-0148.md): In multiple functions of VideoRtpPayloadDecoderNode.cpp, there is a possible out of bounds write due to an integer overflow. (CVSS 8.8, Google Android)
- [CVE-2026-0147](https://cve.now/CVE-2026-0147.md): In \_\_mfc\_core\_nal\_q\_get\_dec\_metadata\_sei\_nal of mfc\_core\_nal\_q.c, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, Google Android)
- [CVE-2026-0146](https://cve.now/CVE-2026-0146.md): In mfc\_core\_get\_dec\_metadata\_sei\_nal of mfc\_core\_reg\_api.c, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, Google Android)
- [CVE-2026-0145](https://cve.now/CVE-2026-0145.md): In keymint, there is a possible Permission Bypass due to a logic error in the code. (CVSS 4.0, Google Android)
- [CVE-2026-0144](https://cve.now/CVE-2026-0144.md): In writeAocCommand of AocAudioCodec.cpp, there is a possible memory safety issue due to a missing bounds check. (CVSS 7.5, Google Android)
- [CVE-2026-0143](https://cve.now/CVE-2026-0143.md): In lwis\_device\_external\_event\_emit of lwis\_event.c, there is a possible memory corruption due to a use after free. (CVSS 7.8, Google Android)
- [CVE-2026-0142](https://cve.now/CVE-2026-0142.md): In iavb\_parse\_key\_data of avb\_rsa.c, there is a possible out of bounds read due to improper input validation. (CVSS 4.0, Google Android)
- [CVE-2026-0141](https://cve.now/CVE-2026-0141.md): In decodeAppPacket of RtcpAppPacket.cpp, there is a possible OOB read due to a missing bounds check. (CVSS 5.3, Google Android)
- [CVE-2026-0140](https://cve.now/CVE-2026-0140.md): In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow. (CVSS 4.3, Google Android)
- [CVE-2026-0139](https://cve.now/CVE-2026-0139.md): In Modem, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, Google Android)
- [CVE-2026-0138](https://cve.now/CVE-2026-0138.md): In lwis\_io\_buffer\_write of lwis\_io\_buffer.c, there is a possible out of bounds write due to memory corruption. (CVSS 7.8, Google Android)
- [CVE-2026-0137](https://cve.now/CVE-2026-0137.md): In edgetpu\_sync\_fence\_group\_shutdown() of edgetpu-dmabuf.c, there is a possible elevation of privilege due to a use after free. (CVSS 7.8, Google Android)
- [CVE-2026-0136](https://cve.now/CVE-2026-0136.md): In Modem, there is a possible out of bounds read due to a missing bounds check. (CVSS 7.5, Google Android)
- [CVE-2026-0135](https://cve.now/CVE-2026-0135.md): In Modem, there is a possible out of bounds read due to a missing bounds check. (CVSS 7.8, Google Android)
- [CVE-2026-0134](https://cve.now/CVE-2026-0134.md): In PostWipeData of recovery\_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code. (CVSS 4.0, Google Android)
- [CVE-2026-0133](https://cve.now/CVE-2026-0133.md): In smmu\_attach\_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due to a missing permissi (CVSS 7.8, Google Android)
- [CVE-2026-0132](https://cve.now/CVE-2026-0132.md): In Modem, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 8.8, Google Android)
- [CVE-2026-0131](https://cve.now/CVE-2026-0131.md): In RtpPacket::decodePacket, there is a possible out of bounds access due to an integer overflow. (CVSS 7.3, Google Android)
- [CVE-2026-0130](https://cve.now/CVE-2026-0130.md): In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow. (CVSS 4.3, Google Android)
- [CVE-2026-0129](https://cve.now/CVE-2026-0129.md): In RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check. (CVSS 4.3, Google Android)
- [CVE-2026-0128](https://cve.now/CVE-2026-0128.md): In RtcpFbPacket::decodeRtcpFbPacket, there is a possible out of bounds read due to an integer overflow. (CVSS 4.3, Google Android)
- [CVE-2026-0127](https://cve.now/CVE-2026-0127.md): In NrmmMsgCodec::DecodeUPUTransparentContext of cn\_NrmmDecoder.cpp, there is a possible out-of-bounds read due to memory corruption. (CVSS 6.5, Google Android)
- [CVE-2026-0126](https://cve.now/CVE-2026-0126.md): In WC-Radio, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, Google Android)
- [CVE-2026-0125](https://cve.now/CVE-2026-0125.md): In multiple functions of vpu\_ioctl.c, there is a possible use after free due to a race condition. (CVSS 7.0, Google Android)
- [CVE-2026-48777](https://cve.now/CVE-2026-48777.md): FileBrowser Quantum: Path Traversal in public share PATCH allows file ops outside shared directory (CVSS 9.3, gtsteffaniak filebrowser · github.com/gtsteffaniak/filebrow…)
- [CVE-2026-22313](https://cve.now/CVE-2026-22313.md): OS Commands Executed with Administrative Permissions in Radiflow iSAP Smart Collector (CVSS 9.1, Radiflow iSAP Smart Collector)
- [CVE-2026-12425](https://cve.now/CVE-2026-12425.md): Reflected / DOM cross-site scripting (XSS) in PowerSchool ERP / Employee Access Center 23.10 (CVSS 5.7, PowerSchool Employee Access Center)
- [CVE-2026-47747](https://cve.now/CVE-2026-47747.md): stable-diffusion.cpp has a Heap-based Buffer Overflow (CVSS 7.8, leejet stable-diffusion.cpp)
- [CVE-2026-12105](https://cve.now/CVE-2026-12105.md): Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication (CVSS 6.5, Devolutions Server)
- [CVE-2026-12117](https://cve.now/CVE-2026-12117.md): Improper access control in the social login connection endpoint in Devolutions Server 2026.2.5 allows an authenticated vault member to enu (CVSS 4.3, Devolutions Server)
- [CVE-2026-10303](https://cve.now/CVE-2026-10303.md): ServerCo getssl ACME shell script path injection (CVSS 7.4, ServerCo getssl)
- [CVE-2026-11890](https://cve.now/CVE-2026-11890.md): Improper access control in PAM account discovery results in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to retrieve (CVSS 4.3, Devolutions Server)
- [CVE-2026-22312](https://cve.now/CVE-2026-22312.md): Use of Hard-coded Credentials Vulnerability in Radiflow iSAP Smart Collector (CVSS 8.6, Radiflow iSAP Smart Collector)
- [CVE-2026-47750](https://cve.now/CVE-2026-47750.md): stable-diffusion.cpp: Heap buffer overflow in GLOBAL opcode parsing for PyTorch checkpoint files (CVSS 7.8, leejet stable-diffusion.cpp)
- [CVE-2026-53866](https://cve.now/CVE-2026-53866.md): OpenClaw \< 2026.5.12 - Allowlist Bypass in Shell Inline-Command Parsing (CVSS 7.6, OpenClaw)
- [CVE-2026-53865](https://cve.now/CVE-2026-53865.md): OpenClaw \< 2026.5.2 - Arbitrary Command Execution via Workspace-Derived Service PATH (CVSS 7.2, OpenClaw)
- [CVE-2026-53864](https://cve.now/CVE-2026-53864.md): OpenClaw \< 2026.5.26 - Insufficient Environment Variable Sanitization in Node.js Control Variables (CVSS 7.6, OpenClaw)
- [CVE-2026-53863](https://cve.now/CVE-2026-53863.md): OpenClaw \< 2026.4.25 - Unvalidated Group ID Acceptance in Tool Group Policy (CVSS 6.0, OpenClaw)
- [CVE-2026-53862](https://cve.now/CVE-2026-53862.md): OpenClaw \< 2026.5.12 - Bootstrap Token Replay via Pending Pairing Scope Widening (CVSS 2.3, OpenClaw)
- [CVE-2026-53861](https://cve.now/CVE-2026-53861.md): OpenClaw \< 2026.5.6 - Allowlist Bypass via Combined POSIX Inline Flags on macOS (CVSS 5.3, OpenClaw)
- [CVE-2026-53860](https://cve.now/CVE-2026-53860.md): OpenClaw \< 2026.5.7 - Sender Policy Bypass via Mutable Conversation Identifiers in BlueBubbles (CVSS 2.3, OpenClaw)
- [CVE-2026-53859](https://cve.now/CVE-2026-53859.md): OpenClaw \< 2026.5.26 - Hostname Validation Bypass via Trailing-Dot Inconsistency (CVSS 6.0, OpenClaw)
- [CVE-2026-53858](https://cve.now/CVE-2026-53858.md): OpenClaw \< 2026.5.2 - Arbitrary Runtime Dependency Loading via STATE\_DIRECTORY Environment Variable (CVSS 7.0, OpenClaw)
- [CVE-2026-53857](https://cve.now/CVE-2026-53857.md): OpenClaw \< 2026.5.3 - Mutable Display Name Binding in Zalo allowFrom Policy (CVSS 8.6, OpenClaw)
- [CVE-2026-53856](https://cve.now/CVE-2026-53856.md): OpenClaw 2026.4.23 \< 2026.4.24 - Insecure File Permissions in Config Recovery via OpenClaw.json (CVSS 5.7, OpenClaw)
- [CVE-2026-53855](https://cve.now/CVE-2026-53855.md): OpenClaw \< 2026.4.2 - Shell Positional Parameters Bypass in Inline-Eval Checks (CVSS 7.6, OpenClaw)
- [CVE-2026-53854](https://cve.now/CVE-2026-53854.md): OpenClaw \< 2026.4.25 - Privilege Escalation via ownerAllowFrom Wildcard Inheritance in Internal/Webchat Commands (CVSS 6.0, OpenClaw)
- [CVE-2026-53853](https://cve.now/CVE-2026-53853.md): OpenClaw \< 2026.5.12 - Argument Pattern Bypass in Exec Allowlist via Linux and macOS (CVSS 7.6, OpenClaw)
- [CVE-2026-53852](https://cve.now/CVE-2026-53852.md): OpenClaw \< 2026.4.25 - Scope Bypass via Empty-Scope Device Re-pairing (CVSS 2.3, OpenClaw)
- [CVE-2026-53851](https://cve.now/CVE-2026-53851.md): OpenClaw \< 2026.5.12 - Slack Reaction Event Notification Bypass (CVSS 6.3, OpenClaw)
- [CVE-2026-53850](https://cve.now/CVE-2026-53850.md): OpenClaw \< 2026.4.25 - Control Scope Enforcement Bypass in Focus Command (CVSS 6.8, OpenClaw)
- [CVE-2026-53849](https://cve.now/CVE-2026-53849.md): OpenClaw \< 2026.5.7 - Privilege Escalation via Mutable Discord Display Names in allowFrom (CVSS 8.6, OpenClaw)
- [CVE-2026-53848](https://cve.now/CVE-2026-53848.md): OpenClaw \< 2026.5.26 - Exec Allowlist Bypass via Transparent Command Wrappers (CVSS 2.3, OpenClaw)
- [CVE-2026-53847](https://cve.now/CVE-2026-53847.md): OpenClaw \< 2026.5.6 - Privilege Escalation via Active Memory Write Scope (CVSS 5.3, OpenClaw)
- [CVE-2026-53846](https://cve.now/CVE-2026-53846.md): OpenClaw \< 2026.4.29 - Arbitrary Package Manager Execution via Workspace .env npm\_execpath (CVSS 7.0, OpenClaw)
- [CVE-2026-53845](https://cve.now/CVE-2026-53845.md): OpenClaw \< 2026.5.6 - Skill-Command Dispatch Hook Bypass via Before-Tool-Call Hook Skipping (CVSS 2.3, OpenClaw)
- [CVE-2026-53844](https://cve.now/CVE-2026-53844.md): OpenClaw \< 2026.4.29 - Session Visibility Check Bypass in Shared Memory Search (CVSS 6.0, OpenClaw)
- [CVE-2026-53843](https://cve.now/CVE-2026-53843.md): OpenClaw \< 2026.5.26 - Node Token Revocation Bypass via Pairing-Scoped Device Session (CVSS 8.7, OpenClaw)
- [CVE-2026-53842](https://cve.now/CVE-2026-53842.md): OpenClaw \< 2026.5.2 - Arbitrary Python Runtime Execution via CLOUDSDK\_PYTHON Environment Variable (CVSS 7.0, OpenClaw)
- [CVE-2026-53841](https://cve.now/CVE-2026-53841.md): OpenClaw \< 2026.5.12 - Cross-Site Scripting via Unsafe Markdown Links in Exported Session HTML (CVSS 2.1, OpenClaw)
- [CVE-2026-53840](https://cve.now/CVE-2026-53840.md): OpenClaw \< 2026.5.12 - Custom Header Leakage via MCP Streamable HTTP Cross-Origin Redirects (CVSS 6.0, OpenClaw)
- [CVE-2026-50656](https://cve.now/CVE-2026-50656.md): Microsoft Defender Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Malware Protection Engine)
- [CVE-2024-39575](https://cve.now/CVE-2024-39575.md): update\_disk\_psu\_baseline.sh requires password in plain text (CVSS 7.4, Dell EMC VxRail Appliance)
- [CVE-2026-48775](https://cve.now/CVE-2026-48775.md): LangGraph Checkpoint: Unsafe JSON deserialization in checkpoint loading (CVSS 6.8, langchain-ai langgraph · langchain-ai langraph-checkpoint +1)
- [CVE-2026-10748](https://cve.now/CVE-2026-10748.md): Nexus Repository 3 - Remote Code Execution via License Deserialization (CVSS 8.6, Sonatype Nexus Repository)
- [CVE-2026-47749](https://cve.now/CVE-2026-47749.md): stable-diffusion.cpp: Heap buffer overflow in SHORT\_BINUNICODE parsing for PyTorch checkpoint files (CVSS 7.8, leejet stable-diffusion.cpp)
- [CVE-2026-47748](https://cve.now/CVE-2026-47748.md): stable-diffusion.cpp: Out-of-bounds reads in PyTorch checkpoint pickle opcode parsing (CVSS 5.5, leejet stable-diffusion.cpp)
- [CVE-2026-4367](https://cve.now/CVE-2026-4367.md): Libxpm: libxpm: denial of service via out-of-bounds read in xpm file parsing (CVSS 5.5, Red Hat Hardened Images · Red Hat Enterprise Linux)
- [CVE-2026-47963](https://cve.now/CVE-2026-47963.md): DNG SDK | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe DNG Software Development Kit)
- [CVE-2026-47934](https://cve.now/CVE-2026-47934.md): DNG SDK | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe DNG Software Development Kit)
- [CVE-2026-47964](https://cve.now/CVE-2026-47964.md): DNG SDK | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe DNG Software Development Kit)
- [CVE-2026-47927](https://cve.now/CVE-2026-47927.md): DNG SDK | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe DNG Software Development Kit)
- [CVE-2024-38487](https://cve.now/CVE-2024-38487.md): api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintend (CVSS 7.0, Dell EMC VxRail Appliance)
- [CVE-2026-42089](https://cve.now/CVE-2026-42089.md): yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation (CVSS 8.6, yeoman environment · yeoman-environment)
- [CVE-2026-24228](https://cve.now/CVE-2026-24228.md): NVIDIA NeMo Framework for Linux contains a vulnerability where an attacker may cause deserialization of untrusted data. (CVSS 7.8, NVIDIA NeMo Framework)
- [CVE-2026-24155](https://cve.now/CVE-2026-24155.md): NVIDIA NeMo Framework for all platforms contains a code injection vulnerability. (CVSS 7.8, NVIDIA NeMo Framework)
- [CVE-2024-30476](https://cve.now/CVE-2024-30476.md): PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. (CVSS 5.4, Dell PowerStore)
- [CVE-2026-10649](https://cve.now/CVE-2026-10649.md): Pacemaker: pacemaker: denial of service via integer overflow in remote message decompression (CVSS 8.6, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2025-71261](https://cve.now/CVE-2025-71261.md): Harvester's SUSE Virtualization Registration Client Vulnerable to MITM and DOS (CVSS 8.6, SUSE Harvester · github.com/harvester/harvester)
- [CVE-2026-44932](https://cve.now/CVE-2026-44932.md): indirect remote shell command injection via unsanitized DHCP options in wicked (CVSS 8.8, SUSE wicked)
- [CVE-2024-24909](https://cve.now/CVE-2024-24909.md): Dell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution vulnerability in the gateway plugin. (CVSS 8.8, Dell OpenManage)
- [CVE-2026-53776](https://cve.now/CVE-2026-53776.md): Perry \< 0.5.1166 JWT Expiration Bypass via verify\_decode (CVSS 9.3, PerryTS perry)
- [CVE-2026-12003](https://cve.now/CVE-2026-12003.md): CPython \>3.11 Insecure Input Validation resulting in privilege escalation (CVSS 5.3, Python Software Foundation CPython)
- [CVE-2024-22451](https://cve.now/CVE-2024-22451.md): Dell Peripheral Manager, versions from 1.5.1 to 1.7.2, contain an uncontrolled search path element vulnerability. (CVSS 6.7, Dell Peripheral Manager)
- [CVE-2026-12398](https://cve.now/CVE-2026-12398.md): Galaxy\_ng: shell injection in legacy role import via unsanitized git ref names (CVSS 7.5, Red Hat Ansible Automation Platform · galaxy-ng)
- [CVE-2026-47684](https://cve.now/CVE-2026-47684.md): Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP (CVSS 7.7, Sync-in server · @sync-in/server)
- [CVE-2026-0647](https://cve.now/CVE-2026-0647.md): Rockwell Automation FLEX I/O Dual-port EtherNet/IP Adapters – Multiple Vulnerabilities (CVSS 8.8, Rockwell Automation FLEX I/O EtherNet/IP Adapters)
- [CVE-2026-0646](https://cve.now/CVE-2026-0646.md): Rockwell Automation FLEX I/O Dual-port EtherNet/IP Adapters – Multiple Vulnerabilities (CVSS 8.7, Rockwell Automation FLEX I/O EtherNet/IP Adapters)
- [CVE-2026-48780](https://cve.now/CVE-2026-48780.md): Forem vulnerable to bypass of email address domain restrictions (CVSS 8.2, forem)
- [CVE-2024-22447](https://cve.now/CVE-2024-22447.md): Dell Peripheral Manager, versions prior to 1.7.3, contain an uncontrolled search path element vulnerability. (CVSS 6.7, Dell Peripheral Manager)
- [CVE-2025-14272](https://cve.now/CVE-2025-14272.md): Rockwell Automation FactoryTalk Analytics PavilionX (CVSS 8.3, Rockwell Automation FactoryTalk Analytics PavilionX)
- [CVE-2025-13036](https://cve.now/CVE-2025-13036.md): Rockwell Automation FactoryTalk Historian Site Edition - Authentication Bypass (CVSS 9.2, Rockwell Automation FactoryTalk Historian SE)
- [CVE-2026-10831](https://cve.now/CVE-2026-10831.md): Improper Authorization of Break Signal Commands in Devices (CVSS 6.9, Moxa NPort 6000 Series · Moxa CN2600 Series)
- [CVE-2026-9307](https://cve.now/CVE-2026-9307.md): Rockwell Automation CompactLogix 5370 Controllers – Multiple Vulnerabilities (CVSS 6.3, Rockwell Automation CompactLogix)
- [CVE-2025-11694](https://cve.now/CVE-2025-11694.md): Rockwell Automation CompactLogix 5370 Controllers – Multiple Vulnerabilities (CVSS 8.7, Rockwell Automation CompactLogix)
- [CVE-2026-10640](https://cve.now/CVE-2026-10640.md): Use-after-free reading \`net\_pkt\` \`iface\` after send in IPv6 Neighbor Discovery (\`ipv6\_nbr.c\`) (CVSS 4.2, zephyrproject zephyr)
- [CVE-2026-10639](https://cve.now/CVE-2026-10639.md): Use-after-free reading \`net\_pkt\_iface()\` of a sent ICMPv4 echo-reply packet in \`icmpv4\_handle\_echo\_request()\` (CVSS 4.8, zephyrproject zephyr)
- [CVE-2026-10638](https://cve.now/CVE-2026-10638.md): Use-after-free in Zephyr ICMPv6 RX path when updating statistics after sending an echo reply or error (CVSS 5.9, zephyrproject zephyr)
- [CVE-2026-10637](https://cve.now/CVE-2026-10637.md): Use-after-free of \`net\_pkt\` in IPv6 MLD send path triggerable by a link-local MLD Query (CVSS 5.9, zephyrproject zephyr)
- [CVE-2026-10636](https://cve.now/CVE-2026-10636.md): Use-after-free in Zephyr IPv4 IGMP send path (\`igmp\_send\`) (CVSS 3.7, zephyrproject zephyr)
- [CVE-2026-11317](https://cve.now/CVE-2026-11317.md): Rockwell Automation Logix 5370 and 5570 Controllers Vulnerable To Denial of Service Via CIP (CVSS 8.7, Rockwell Automation CompactLogix, ControlLogix)
- [CVE-2026-53900](https://cve.now/CVE-2026-53900.md): Cookie injection was possible when opening a PDF link (CVSS 4.3, Mozilla Firefox for iOS)
- [CVE-2026-53899](https://cve.now/CVE-2026-53899.md): Cross-origin cookies could be leaked when opening a PDF link (CVSS 6.5, Mozilla Firefox for iOS)
- [CVE-2026-12330](https://cve.now/CVE-2026-12330.md): Incorrect boundary conditions in the Internationalization component (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12329](https://cve.now/CVE-2026-12329.md): Memory safety bug fixed in Thunderbird ESR 140.12 (CVSS 5.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12328](https://cve.now/CVE-2026-12328.md): Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12327](https://cve.now/CVE-2026-12327.md): Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12326](https://cve.now/CVE-2026-12326.md): Memory safety bugs fixed in Firefox 152 and Thunderbird 152 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12325](https://cve.now/CVE-2026-12325.md): Denial-of-service in the Graphics: ImageLib component (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12324](https://cve.now/CVE-2026-12324.md): Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 7.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12323](https://cve.now/CVE-2026-12323.md): Spoofing issue in the DOM: Core & HTML component (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12322](https://cve.now/CVE-2026-12322.md): Clickjacking issue in the Widget: Gtk component (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12321](https://cve.now/CVE-2026-12321.md): JIT miscompilation in the JavaScript: WebAssembly component (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12320](https://cve.now/CVE-2026-12320.md): Information disclosure in the Password Manager component (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12319](https://cve.now/CVE-2026-12319.md): Denial-of-service in the Audio/Video: Playback component (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12318](https://cve.now/CVE-2026-12318.md): Incorrect boundary conditions in the Libraries component in NSS (CVSS 7.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12317](https://cve.now/CVE-2026-12317.md): Memory safety bug fixed in Thunderbird 152 (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12316](https://cve.now/CVE-2026-12316.md): Mitigation bypass in the DOM: Security component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12315](https://cve.now/CVE-2026-12315.md): Mitigation bypass in the DOM: Security component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12314](https://cve.now/CVE-2026-12314.md): Memory safety bug fixed in Thunderbird 152 (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12313](https://cve.now/CVE-2026-12313.md): Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVSS 4.7, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12312](https://cve.now/CVE-2026-12312.md): Memory safety bug fixed in Thunderbird 152 (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12311](https://cve.now/CVE-2026-12311.md): Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVSS 4.7, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12310](https://cve.now/CVE-2026-12310.md): Memory safety bug fixed in Thunderbird 152 (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12309](https://cve.now/CVE-2026-12309.md): Memory safety bug fixed in Thunderbird 152 (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12308](https://cve.now/CVE-2026-12308.md): Memory safety bug fixed in Thunderbird 152 (CVSS 5.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12307](https://cve.now/CVE-2026-12307.md): Memory safety bug fixed in Thunderbird 152 (CVSS 5.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12306](https://cve.now/CVE-2026-12306.md): Memory safety bug fixed in Thunderbird 152 (CVSS 5.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12305](https://cve.now/CVE-2026-12305.md): Memory safety bug fixed in Thunderbird 152 (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12304](https://cve.now/CVE-2026-12304.md): Same-origin policy bypass in the Networking: Cookies component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12303](https://cve.now/CVE-2026-12303.md): Information disclosure due to incorrect boundary conditions in the Graphics: WebGPU component (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12302](https://cve.now/CVE-2026-12302.md): Mitigation bypass in the DOM: Security component (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12301](https://cve.now/CVE-2026-12301.md): Memory safety bug fixed in Thunderbird 152 (CVSS 5.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12300](https://cve.now/CVE-2026-12300.md): Memory safety bug fixed in Thunderbird 152 (CVSS 5.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12299](https://cve.now/CVE-2026-12299.md): JIT miscompilation in the DOM: Core & HTML component (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12298](https://cve.now/CVE-2026-12298.md): Memory safety bug fixed in Thunderbird 152 (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12297](https://cve.now/CVE-2026-12297.md): Sandbox escape due to incorrect boundary conditions in the Networking component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12296](https://cve.now/CVE-2026-12296.md): Sandbox escape in the Security: Process Sandboxing component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12295](https://cve.now/CVE-2026-12295.md): Sandbox escape in the DOM: Navigation component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12294](https://cve.now/CVE-2026-12294.md): Sandbox escape in the DOM: Workers component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12293](https://cve.now/CVE-2026-12293.md): Use-after-free in the Graphics: WebGPU component (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12292](https://cve.now/CVE-2026-12292.md): Incorrect boundary conditions in the Web Audio component (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12291](https://cve.now/CVE-2026-12291.md): Use-after-free in the Networking: HTTP component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12290](https://cve.now/CVE-2026-12290.md): Memory safety bug fixed in Thunderbird 152 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-12289](https://cve.now/CVE-2026-12289.md): Privilege escalation in the Graphics: WebRender component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-9507](https://cve.now/CVE-2026-9507.md): Session fixation vulnerability in Enhancesoft's osTicket (CVSS 5.1, Enhancesoft osTicket)
- [CVE-2026-12225](https://cve.now/CVE-2026-12225.md): syracom Secure Login (2FA) for Confluence allows 2FA bypass via spoofed User-Agent (CVSS 8.7, syracom AG Secure Login (2FA) for Jira · syracom AG Secu… +1)
- [CVE-2026-40750](https://cve.now/CVE-2026-40750.md): WordPress Kids Online Store theme \<= 0.8.9 - Arbitrary File Upload vulnerability (CVSS 9.9, themagnifico52 Kids Online Store)
- [CVE-2026-8484](https://cve.now/CVE-2026-8484.md): Heap buffer overflow in Jansi (CVSS 4.8, FuseSource jansi)
- [CVE-2026-10829](https://cve.now/CVE-2026-10829.md): A stack-based buffer overflow vulnerability has been found in the NPort W2150A-W4/W2250A-W4 Series version 1.5 and earlier. (CVSS 8.6, Moxa NPort W2150A-W4/W2250A-W4 Series · Moxa NPort W2150A/W…)
- [CVE-2026-10828](https://cve.now/CVE-2026-10828.md): A format string vulnerability has been found in the "alias" parameter of the Serial Param configuration page in the NPort W2150A-W4/W2250A-W (CVSS 6.9, Moxa NPort W2150A-W4/W2250A-W4 Series · Moxa NPort W2150A/W…)
- [CVE-2026-8442](https://cve.now/CVE-2026-8442.md): WP Review Slider Pro \<= 12.6.8 - Authenticated (Subscriber+) Arbitrary File Deletion via 'myaction' Parameter (CVSS 8.1, https://wpreviewslider.com/ WP Review Slider Pro)
- [CVE-2026-8176](https://cve.now/CVE-2026-8176.md): LatePoint \<= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create\_or\_update + Unauthenticated Customer-Cabinet Password Reset (CVSS 7.5, LatePoint – Calendar Booking Plugin for Appointments and Ev…)
- [CVE-2026-2381](https://cve.now/CVE-2026-2381.md): WooCommerce Stripe Payment Gateway \<= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter (CVSS 6.5, WooCommerce Stripe Payment Gateway)
- [CVE-2026-40809](https://cve.now/CVE-2026-40809.md): WordPress Metro Magazine theme \<= 1.4.1 - Broken Access Control vulnerability (CVSS 6.5, Rara Themes Metro Magazine)
- [CVE-2026-49772](https://cve.now/CVE-2026-49772.md): WordPress The Events Calendar plugin 6.15.12-6.16.2 - SQL Injection vulnerability (CVSS 9.3, Liquid Web / StellarWP The Events Calendar)
- [CVE-2026-49774](https://cve.now/CVE-2026-49774.md): WordPress RD Station plugin \<= 5.6.0 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, Filipe Nasc RD Station)
- [CVE-2026-54198](https://cve.now/CVE-2026-54198.md): WordPress Media LIbrary Assistant plugin \<= 3.35 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, David Lingren Media LIbrary Assistant)
- [CVE-2026-54197](https://cve.now/CVE-2026-54197.md): WordPress GetGenie plugin \<= 4.4.1 - Sensitive Data Exposure vulnerability (CVSS 6.5, Wpmet GetGenie)
- [CVE-2026-54191](https://cve.now/CVE-2026-54191.md): WordPress Pods plugin \<= 3.3.8 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pods Framework Pods)
- [CVE-2026-54190](https://cve.now/CVE-2026-54190.md): WordPress Envira Photo Gallery plugin \<= 1.12.5 - Broken Access Control vulnerability (CVSS 6.5, Awesomemotive Envira Photo Gallery)
- [CVE-2026-52715](https://cve.now/CVE-2026-52715.md): WordPress GEO my WordPress plugin \<= 4.5.5 - SQL Injection vulnerability (CVSS 9.3, Eyal Fitoussi GEO my WordPress)
- [CVE-2026-52714](https://cve.now/CVE-2026-52714.md): WordPress SEO Plugin by Squirrly SEO plugin \<= 12.4.16 - Broken Access Control vulnerability (CVSS 7.5, SEO Squirrly SEO Plugin by Squirrly SEO)
- [CVE-2026-52712](https://cve.now/CVE-2026-52712.md): WordPress Attendance Manager plugin \<= 0.6.2 - SQL Injection vulnerability (CVSS 7.6, tnomi Attendance Manager)
- [CVE-2026-52711](https://cve.now/CVE-2026-52711.md): WordPress WooCommerce POS plugin \<= 1.8.14 - Broken Access Control vulnerability (CVSS 7.5, kilbot WooCommerce POS)
- [CVE-2026-39581](https://cve.now/CVE-2026-39581.md): WordPress WP Sessions Time Monitoring Full Automatic plugin \<= 1.1.4 - SQL Injection vulnerability (CVSS 8.5, activity-log.com WP Sessions Time Monitoring Full Automatic)
- [CVE-2026-39574](https://cve.now/CVE-2026-39574.md): WordPress InPost Gallery plugin \<= 2.1.4.6 - SQL Injection vulnerability (CVSS 9.3, RealMag777 InPost Gallery)
- [CVE-2026-39490](https://cve.now/CVE-2026-39490.md): WordPress JupiterX Core plugin \<= 4.14.1 - Broken Access Control vulnerability (CVSS 7.5, artbees JupiterX Core)
- [CVE-2026-39437](https://cve.now/CVE-2026-39437.md): WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin \<= 5.2.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPFactory Min Max Step Quantity Limits Manager for WooComme…)
- [CVE-2025-68045](https://cve.now/CVE-2025-68045.md): WordPress WP Event SOlution plugin \<= 4.1.12 - Broken Access Control vulnerability (CVSS 7.5, Arraytics WP Event Solution)
- [CVE-2026-10825](https://cve.now/CVE-2026-10825.md): Improper JSON Input Validation in WebSocket API Leads to Denial of Service (CVSS 7.1, Moxa NPort 6000-G2 Series)
- [CVE-2026-5416](https://cve.now/CVE-2026-5416.md): Command Injection via name parameter (CVSS 8.8, TURCK TBEN-LL-SE-M2 · TURCK TBEN-L4-SE-M2 +1)
- [CVE-2026-10093](https://cve.now/CVE-2026-10093.md): File Sharing & Download Manager \<= 2.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'fldr\_ttl' Parameter (CVSS 6.4, deepakkite Secure Client Portal and Private File Sharing Pl…)
- [CVE-2026-8444](https://cve.now/CVE-2026-8444.md): WP Review Slider Pro \<= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'curselrevs' Parameter (CVSS 8.8, https://wpreviewslider.com/ WP Review Slider Pro)
- [CVE-2026-46331](https://cve.now/CVE-2026-46331.md): net/sched: fix pedit partial COW leading to page cache corruption (CVSS 7.8, Linux)
- [CVE-2025-9912](https://cve.now/CVE-2025-9912.md): A local privilege escalation vulnerability in Nokia SR Linux (CVSS 6.3, Nokia SR Linux)
- [CVE-2025-10262](https://cve.now/CVE-2025-10262.md): An unsanitized format validation vulnerability in Nokia SR Linux (CVSS 6.3, Nokia SR Linux)
- [CVE-2026-5149](https://cve.now/CVE-2026-5149.md): RTMKit \<= 2.0.7 - Authenticated (Contributor+) Missing Authorization to Arbitrary Form Submission Access via 'entries\_id' Parameter (CVSS 6.5, rometheme RTMKit)
- [CVE-2026-8443](https://cve.now/CVE-2026-8443.md): WP Review Slider Pro \<= 12.6.8 - Authenticated (Subscriber+) SQL Injection via 'stypes' Parameter (CVSS 8.8, https://wpreviewslider.com/ WP Review Slider Pro)
- [CVE-2026-10635](https://cve.now/CVE-2026-10635.md): Dangling memory-domain pointer (use-after-free) in Xtensa MMU page-table code on memory-domain de-init (CVSS 6.3, zephyrproject zephyr)
- [CVE-2026-50255](https://cve.now/CVE-2026-50255.md): Incorrect default permissions issue exists in Optical Disc Archive Software for Windows 5.5.3 and earlier. (CVSS 6.7, Sony Optical Disc Archive Software for Windows)
- [CVE-2026-10780](https://cve.now/CVE-2026-10780.md): Static Block \<= 2.2 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode 'id' Attribute (CVSS 4.3, mohammadtanzilurrahman Static Block)
- [CVE-2026-6933](https://cve.now/CVE-2026-6933.md): Premmerce Dev Tools \<= 2.0 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via Plugin Creation (CVSS 8.8, Premmerce Dev Tools)
- [CVE-2026-9187](https://cve.now/CVE-2026-9187.md): Abandoned Contact Form 7 \<= 2.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'recover\_id' Parameter (CVSS 5.3, zealopensource Abandoned Contact Form)
- [CVE-2026-6964](https://cve.now/CVE-2026-6964.md): Video Conferencing with Zoom \<= 4.6.7 - Missing Authorization to Unauthenticated Zoom SDK Credential Exposure via 'get\_auth' AJAX Action (CVSS 5.3, j\_3rk Video Conferencing with Zoom)
- [CVE-2026-7273](https://cve.now/CVE-2026-7273.md): A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a (CVSS 8.8, KEV, Zyxel GS1900-48HPv2 firmware · Zyxel GS1900-8 firmware +8)
- [CVE-2026-42014](https://cve.now/CVE-2026-42014.md): Gnutls: gnutls: use-after-free in gnutls\_pkcs11\_token\_set\_pin (CVSS 6.6, gnutls · Red Hat Enterprise Linux +6)
- [CVE-2026-1767](https://cve.now/CVE-2026-1767.md): Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leading to denial of service or information disclosure via malformed mp3 id3 tags (CVSS 5.6, Red Hat Enterprise Linux)
- [CVE-2026-1766](https://cve.now/CVE-2026-1766.md): Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and information disclosure via malformed mp3 files. (CVSS 5.6, Red Hat Enterprise Linux)
- [CVE-2026-1765](https://cve.now/CVE-2026-1765.md): Localsearch: tracker-miners: gnome localsearch mp3 extractor: denial of service and potential information disclosure via crafted mp3 files (CVSS 5.6, Red Hat Enterprise Linux)
- [CVE-2026-1764](https://cve.now/CVE-2026-1764.md): Localsearch: tracker-miners: gnome localsearch mp3 extractor: heap buffer overflow leads to denial of service or information disclosure when parsing mp3 files (CVSS 5.6, Red Hat Enterprise Linux)
- [CVE-2026-46448](https://cve.now/CVE-2026-46448.md): In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. (CVSS 5.4, OpenStack Nova · nova)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.