# CVEs published 2026-09-15

1,426 CVEs were published on September 15, 2026: 201 critical, 835 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2026-92184](https://cve.now/CVE-2026-92184.md): ag-ui-protocol ag-ui Multimodal Content utils.py urllib.request.urlopen server-side request forgery (CVSS 5.3, ag-ui-protocol ag-ui)
- [CVE-2026-15640](https://cve.now/CVE-2026-15640.md): Authentication Bypass via SAML Response Manipulation (CVSS 9.5, Delinea Secret Server)
- [CVE-2026-15639](https://cve.now/CVE-2026-15639.md): Reflected Cross-Site Scripting (CVSS 9.3, Delinea Secret Server)
- [CVE-2026-15638](https://cve.now/CVE-2026-15638.md): Cryptographic Padding Oracle (CVSS 9.1, Delinea Secret Server)
- [CVE-2026-73460](https://cve.now/CVE-2026-73460.md): Security Advisory 0160 (CVSS 6.1, Arista Networks EOS)
- [CVE-2026-73459](https://cve.now/CVE-2026-73459.md): Security Advisory 0160 (CVSS 7.4, Arista Networks EOS)
- [CVE-2026-73446](https://cve.now/CVE-2026-73446.md): Security Advisory 0160 (CVSS 7.4, Arista Networks EOS)
- [CVE-2025-11395](https://cve.now/CVE-2025-11395.md): Podman: arbitrary file write when importing oci archive (CVSS 5.5, Red Hat Enterprise Linux · Red Hat Hardened Images +2)
- [CVE-2026-85893](https://cve.now/CVE-2026-85893.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Edge)
- [CVE-2026-69486](https://cve.now/CVE-2026-69486.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Edge)
- [CVE-2026-92248](https://cve.now/CVE-2026-92248.md): Gimp: integer overflow when generating a thumbnail preview for a psd file (CVSS 7.8, GNOME GIMP · Red Hat Enterprise Linux)
- [CVE-2026-92257](https://cve.now/CVE-2026-92257.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinks (CVSS 5.1, Netcore NR255-V)
- [CVE-2026-92256](https://cve.now/CVE-2026-92256.md): Netcore NR255-V 1.5.130703 IPsec PSK and RSA Key Disclosure via l2tpd\_config\_show.cgi Read Handlers (CVSS 7.1, Netcore NR255-V)
- [CVE-2026-92255](https://cve.now/CVE-2026-92255.md): Netcore NR255-V 1.5.130703 Out-of-Bounds Read in filter\_arp\_put\_file.cgi via String API Misuse (CVSS 5.3, Netcore NR255-V)
- [CVE-2026-76873](https://cve.now/CVE-2026-76873.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP and ARP Hostname Fields (CVSS 5.1, Netcore NR255-V)
- [CVE-2026-76872](https://cve.now/CVE-2026-76872.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP/ACL Management Pages (CVSS 5.1, Netcore NR255-V)
- [CVE-2026-76871](https://cve.now/CVE-2026-76871.md): Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via VPN Read Handlers (CVSS 7.1, Netcore NR255-V)
- [CVE-2026-76870](https://cve.now/CVE-2026-76870.md): Netcore NR255-V 1.5.130703 Out-of-Bounds Read in mtd\_write Firmware Upload Validation (CVSS 7.1, Netcore NR255-V)
- [CVE-2026-76869](https://cve.now/CVE-2026-76869.md): Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in reboot\_timer\_set.cgi (CVSS 8.6, Netcore NR255-V)
- [CVE-2026-76868](https://cve.now/CVE-2026-76868.md): Netcore NR255-V 1.5.130703 NULL Pointer Dereference in route\_policy\_add.cgi via Missing exit\_port (CVSS 6.9, Netcore NR255-V)
- [CVE-2026-76867](https://cve.now/CVE-2026-76867.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in Route/NAT Configuration CGI Handlers (CVSS 5.1, Netcore NR255-V)
- [CVE-2026-76866](https://cve.now/CVE-2026-76866.md): Netcore NR255-V 1.5.130703 OS Command Argument Injection via Unquoted DDNS Parameters (CVSS 8.6, Netcore NR255-V)
- [CVE-2026-76865](https://cve.now/CVE-2026-76865.md): Netcore NR255-V 1.5.130703 NULL Pointer Dereference via Unchecked atoi() in QoS Setter Handlers (CVSS 6.9, Netcore NR255-V)
- [CVE-2026-76864](https://cve.now/CVE-2026-76864.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via Unescaped QoS Rule Names (CVSS 4.8, Netcore NR255-V)
- [CVE-2026-76863](https://cve.now/CVE-2026-76863.md): Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via QoS Bandwidth Plan Routes (CVSS 5.3, Netcore NR255-V)
- [CVE-2026-76862](https://cve.now/CVE-2026-76862.md): Netcore NR255-V 1.5.130703 OS Command Argument Injection in Nettools tcpdump Launch Paths (CVSS 8.7, Netcore NR255-V)
- [CVE-2026-76861](https://cve.now/CVE-2026-76861.md): Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in ntools\_tcpdump\_start\_set.cgi (CVSS 8.7, Netcore NR255-V)
- [CVE-2026-76860](https://cve.now/CVE-2026-76860.md): Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in wake\_up\_set.cgi via MAC and ID Tokenization (CVSS 8.7, Netcore NR255-V)
- [CVE-2026-76859](https://cve.now/CVE-2026-76859.md): Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via user\_pass\_show.cgi (CVSS 7.1, Netcore NR255-V)
- [CVE-2026-76858](https://cve.now/CVE-2026-76858.md): Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns\_wan\_list\_show.cgi (CVSS 4.8, Netcore NR255-V)
- [CVE-2026-76857](https://cve.now/CVE-2026-76857.md): Netcore NR255-V 1.5.130703 Plaintext DDNS Credential Disclosure via ddns\_wan\_list\_show.cgi (CVSS 7.1, Netcore NR255-V)
- [CVE-2026-76856](https://cve.now/CVE-2026-76856.md): Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints (CVSS 7.0, Netcore NR255-V)
- [CVE-2026-76855](https://cve.now/CVE-2026-76855.md): Netcore NR255-V 1.5.130703 Cross-User Session Disclosure via Audit Endpoints (CVSS 7.1, Netcore NR255-V)
- [CVE-2026-76854](https://cve.now/CVE-2026-76854.md): Netcore NR255-V 1.5.130703 Sensitive Information Disclosure via l7\_web\_auth\_user\_show.cgi (CVSS 7.1, Netcore NR255-V)
- [CVE-2026-76853](https://cve.now/CVE-2026-76853.md): Netcore NR268 1.7.121109 Security Check Bypass in parame\_put\_file.cgi (CVSS 7.2, Netcore NR268)
- [CVE-2026-76852](https://cve.now/CVE-2026-76852.md): Netcore NR268 1.7.121109 Forgeable Firmware Authenticity Check in mtd\_write (CVSS 8.7, Netcore NR268)
- [CVE-2026-83368](https://cve.now/CVE-2026-83368.md): Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, Oracle GraalVM product of Oracle Java SE (component: Compile (CVSS 7.0, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition,…)
- [CVE-2026-83408](https://cve.now/CVE-2026-83408.md): Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). (CVSS 8.1, Oracle GraalVM for JDK, Oracle GraalVM)
- [CVE-2026-83357](https://cve.now/CVE-2026-83357.md): Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). (CVSS 8.1, Oracle GraalVM for JDK, Oracle GraalVM)
- [CVE-2026-82567](https://cve.now/CVE-2026-82567.md): mySCADA myPRO Manager Missing Authorization (CVSS 6.3, mySCADA Technologies mySCADA myPRO)
- [CVE-2026-73807](https://cve.now/CVE-2026-73807.md): mySCADA myPRO Manager Missing Authorization (CVSS 9.8, mySCADA Technologies mySCADA myPRO)
- [CVE-2026-92259](https://cve.now/CVE-2026-92259.md): Integer overflow or wraparound vulnerability in Samsung Opensource Escargot allows attackers with write access to the bytecode-cache directo (CVSS 5.5, Samsung Opensource Escargot)
- [CVE-2026-81855](https://cve.now/CVE-2026-81855.md): Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key (CVSS 9.1, Wärtsilä FOS-Onboard)
- [CVE-2026-92114](https://cve.now/CVE-2026-92114.md): a2ui-project a2ui Basic Catalog safe\_regex.ts redos (CVSS 6.9, a2ui-project a2ui)
- [CVE-2026-78225](https://cve.now/CVE-2026-78225.md): Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key (CVSS 9.0, Wärtsilä FOS-Onboard)
- [CVE-2026-73444](https://cve.now/CVE-2026-73444.md): On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker with access to the layer 2 network segment on which VRRP is running could bypass VRRP authentication and claim the (CVSS 4.7, Arista Networks EOS)
- [CVE-2026-61560](https://cve.now/CVE-2026-61560.md): @zereight/mcp-gitlab's unauthenticated arbitrary file read via \`upload\_markdown\` enables PAT exfiltration and full account takeover (CVSS 9.8, zereight gitlab-mcp · @zereight/mcp-gitlab)
- [CVE-2026-73437](https://cve.now/CVE-2026-73437.md): On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay configured, an unauthenticated attacker with network access could send a crafted DHCP reply packet from an IP address that is not configured as a helper/destinat (CVSS 9.6, Arista Networks EOS)
- [CVE-2026-10144](https://cve.now/CVE-2026-10144.md): Rsbuild \< 2.0.9 Command Injection via openBrowser() URL Handling (CVSS 7.1, web-infra-dev rsbuild)
- [CVE-2026-68491](https://cve.now/CVE-2026-68491.md): An insufficient check allowed for the overwrite of arbitrary files via a symlink. (CVSS 9.4, Webpros SolusVM)
- [CVE-2026-61559](https://cve.now/CVE-2026-61559.md): @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery (CVSS 9.6, zereight gitlab-mcp · @zereight/mcp-gitlab)
- [CVE-2026-19655](https://cve.now/CVE-2026-19655.md): On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information option (Option 82), or with the DHCP server configured with match criteria based on the information option, an unauthent (CVSS 6.5, Arista Networks EOS)
- [CVE-2026-92234](https://cve.now/CVE-2026-92234.md): QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors (CVSS 5.1, Webkul QloApps)
- [CVE-2026-92000](https://cve.now/CVE-2026-92000.md): adm-zip 0.5.14 through 0.6.0 Denial of Service via Zero Declared Uncompressed Size (CVSS 8.7, cthackers adm-zip · adm-zip)
- [CVE-2026-91939](https://cve.now/CVE-2026-91939.md): Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter (CVSS 9.3, Cotonti)
- [CVE-2026-61568](https://cve.now/CVE-2026-61568.md): @zereight/mcp-gitlab: DNS rebinding reaches local Streamable HTTP MCP transport (CVSS 9.6, zereight gitlab-mcp · @zereight/mcp-gitlab)
- [CVE-2026-61554](https://cve.now/CVE-2026-61554.md): emp3r0r has an unauthenticated HTTP Polling DoS (CVSS 7.5, jm33-m0 emp3r0r · github.com/jm33-m0/emp3r0r/core)
- [CVE-2026-91719](https://cve.now/CVE-2026-91719.md): Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (CVSS 4.3, Google Chrome)
- [CVE-2026-91722](https://cve.now/CVE-2026-91722.md): Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the (CVSS 8.8, Google Chrome)
- [CVE-2026-91730](https://cve.now/CVE-2026-91730.md): Incomplete cleanup in GetUserMedia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer proces (CVSS 3.1, Google Chrome)
- [CVE-2026-91738](https://cve.now/CVE-2026-91738.md): Improper input validation in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code o (CVSS 9.6, Google Chrome)
- [CVE-2026-91713](https://cve.now/CVE-2026-91713.md): Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process (CVSS 4.2, Google Chrome)
- [CVE-2026-91739](https://cve.now/CVE-2026-91739.md): Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the ren (CVSS 4.2, Google Chrome)
- [CVE-2026-91725](https://cve.now/CVE-2026-91725.md): Observable discrepancy in CSS in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to leak sensitive information via a crafted (CVSS 5.3, Google Chrome)
- [CVE-2026-91714](https://cve.now/CVE-2026-91714.md): Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to leak sens (CVSS 5.3, Google Chrome)
- [CVE-2026-91742](https://cve.now/CVE-2026-91742.md): Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering t (CVSS 4.8, Google Chrome)
- [CVE-2026-91732](https://cve.now/CVE-2026-91732.md): Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer proc (CVSS 3.1, Google Chrome)
- [CVE-2026-91723](https://cve.now/CVE-2026-91723.md): Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML p (CVSS 4.2, Google Chrome)
- [CVE-2026-91745](https://cve.now/CVE-2026-91745.md): Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-91715](https://cve.now/CVE-2026-91715.md): Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandb (CVSS 8.8, Google Chrome)
- [CVE-2026-91711](https://cve.now/CVE-2026-91711.md): Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the (CVSS 8.8, Google Chrome)
- [CVE-2026-91737](https://cve.now/CVE-2026-91737.md): Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-91729](https://cve.now/CVE-2026-91729.md): Use after free in DigitalCredentials in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to exec (CVSS 9.6, Google Chrome)
- [CVE-2026-91746](https://cve.now/CVE-2026-91746.md): Integer overflow in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted (CVSS 4.3, Google Chrome)
- [CVE-2026-91716](https://cve.now/CVE-2026-91716.md): Use after free in Auth in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a (CVSS 9.6, Google Chrome)
- [CVE-2026-91718](https://cve.now/CVE-2026-91718.md): Use after free in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a (CVSS 9.6, Google Chrome)
- [CVE-2026-91710](https://cve.now/CVE-2026-91710.md): Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the san (CVSS 9.6, Google Chrome)
- [CVE-2026-91740](https://cve.now/CVE-2026-91740.md): Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted H (CVSS 4.3, Google Chrome)
- [CVE-2026-91736](https://cve.now/CVE-2026-91736.md): Use after free in DOM in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-91708](https://cve.now/CVE-2026-91708.md): Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obta (CVSS 3.1, Google Chrome)
- [CVE-2026-91735](https://cve.now/CVE-2026-91735.md): Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process (CVSS 8.3, Google Chrome)
- [CVE-2026-91717](https://cve.now/CVE-2026-91717.md): Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive informat (CVSS 5.1, Google Chrome)
- [CVE-2026-91709](https://cve.now/CVE-2026-91709.md): Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandb (CVSS 8.8, Google Chrome)
- [CVE-2026-91741](https://cve.now/CVE-2026-91741.md): Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbo (CVSS 8.8, Google Chrome)
- [CVE-2026-91733](https://cve.now/CVE-2026-91733.md): Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process (CVSS 8.3, Google Chrome)
- [CVE-2026-91747](https://cve.now/CVE-2026-91747.md): Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain (CVSS 3.1, Google Chrome)
- [CVE-2026-91731](https://cve.now/CVE-2026-91731.md): Type confusion in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox (CVSS 8.8, Google Chrome)
- [CVE-2026-91720](https://cve.now/CVE-2026-91720.md): Uninitialized resource in ANGLE in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandbox via a c (CVSS 4.7, Google Chrome)
- [CVE-2026-91748](https://cve.now/CVE-2026-91748.md): Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer pr (CVSS 8.3, Google Chrome)
- [CVE-2026-91712](https://cve.now/CVE-2026-91712.md): Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer pr (CVSS 8.3, Google Chrome)
- [CVE-2026-91744](https://cve.now/CVE-2026-91744.md): Race condition in PlatformIntegration in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the re (CVSS 5.3, Google Chrome)
- [CVE-2026-91743](https://cve.now/CVE-2026-91743.md): Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potenti (CVSS 8.3, Google Chrome)
- [CVE-2026-91727](https://cve.now/CVE-2026-91727.md): Incorrect reference resolution in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised (CVSS 8.1, Google Chrome)
- [CVE-2026-91734](https://cve.now/CVE-2026-91734.md): Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execute arbitrary code out (CVSS 7.4, Google Chrome)
- [CVE-2026-91728](https://cve.now/CVE-2026-91728.md): Integer overflow in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a (CVSS 9.6, Google Chrome)
- [CVE-2026-91724](https://cve.now/CVE-2026-91724.md): Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potent (CVSS 8.3, Google Chrome)
- [CVE-2026-91749](https://cve.now/CVE-2026-91749.md): Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside th (CVSS 9.6, Google Chrome)
- [CVE-2026-91721](https://cve.now/CVE-2026-91721.md): Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside (CVSS 8.8, Google Chrome)
- [CVE-2026-91726](https://cve.now/CVE-2026-91726.md): Out of bounds read in WebGL in Google Chrome on on Android prior to 153.0.8010.47 allowed a remote attacker to read memory outside the sandb (CVSS 4.7, Google Chrome)
- [CVE-2026-66372](https://cve.now/CVE-2026-66372.md): Predictable Seed in Pseudo-Random Number Generator (PRNG) in Digital Watchdog VMAX DVR and NVR Product Lineups (CVSS 6.8, Digital Watchdog VMAX A1 G4 DVR · Digital Watchdog VMAX… +3)
- [CVE-2026-66887](https://cve.now/CVE-2026-66887.md): Missing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups (CVSS 9.6, Digital Watchdog VMAX A1 G4 DVR · Digital Watchdog VMAX… +3)
- [CVE-2026-79994](https://cve.now/CVE-2026-79994.md): Docker Sandboxes UDS forwarder can reach arbitrary host Unix sockets through a symlink race (CVSS 8.7, Docker Sandboxes)
- [CVE-2026-68950](https://cve.now/CVE-2026-68950.md): Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups (CVSS 8.8, Digital Watchdog VMAX A1 G4 DVR · Digital Watchdog VMAX… +3)
- [CVE-2026-68070](https://cve.now/CVE-2026-68070.md): Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups (CVSS 8.8, Digital Watchdog VMAX A1 G4 DVR · Digital Watchdog VMAX… +3)
- [CVE-2026-54544](https://cve.now/CVE-2026-54544.md): Fireshare has unauthenticated SSRF via missing login\_required on webhook test endpoints (CVSS 7.2, ShaneIsrael fireshare)
- [CVE-2026-66890](https://cve.now/CVE-2026-66890.md): Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups (CVSS 9.6, Digital Watchdog VMAX A1 G4 DVR · Digital Watchdog VMAX… +3)
- [CVE-2026-54337](https://cve.now/CVE-2026-54337.md): Fireshare has Unauthenticated Argument Injection to Arbitrary File Write/Overwrite (CVSS 9.8, ShaneIsrael fireshare)
- [CVE-2026-81927](https://cve.now/CVE-2026-81927.md): Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode (CVSS 1.8, Concrete CMS)
- [CVE-2026-68953](https://cve.now/CVE-2026-68953.md): Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups (CVSS 6.5, Digital Watchdog VMAX A1 G4 DVR · Digital Watchdog VMAX… +3)
- [CVE-2026-88065](https://cve.now/CVE-2026-88065.md): \`tts-be\` application has a Broken Access Control vulnerability (CVSS 7.5, NIAEFEUP tts-be)
- [CVE-2026-18426](https://cve.now/CVE-2026-18426.md): Concrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit (CVSS 2.0, Concrete CMS)
- [CVE-2026-92237](https://cve.now/CVE-2026-92237.md): Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier (CVSS 6.5, Devolutions PowerShell Universal)
- [CVE-2026-81926](https://cve.now/CVE-2026-81926.md): Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog (CVSS 2.0, Concrete CMS)
- [CVE-2026-81925](https://cve.now/CVE-2026-81925.md): Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format (CVSS 2.1, Concrete CMS)
- [CVE-2026-87289](https://cve.now/CVE-2026-87289.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-static-content). (CVSS 7.5, Oracle Helidon)
- [CVE-2026-87285](https://cve.now/CVE-2026-87285.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2026-87284](https://cve.now/CVE-2026-87284.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 3.2, Oracle VM VirtualBox)
- [CVE-2026-87283](https://cve.now/CVE-2026-87283.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2026-87282](https://cve.now/CVE-2026-87282.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2026-87281](https://cve.now/CVE-2026-87281.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 3.2, Oracle VM VirtualBox)
- [CVE-2026-87280](https://cve.now/CVE-2026-87280.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 4.2, Oracle VM VirtualBox)
- [CVE-2026-87279](https://cve.now/CVE-2026-87279.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.1, Oracle VM VirtualBox)
- [CVE-2026-87278](https://cve.now/CVE-2026-87278.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.1, Oracle VM VirtualBox)
- [CVE-2026-87277](https://cve.now/CVE-2026-87277.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.5, Oracle VM VirtualBox)
- [CVE-2026-87276](https://cve.now/CVE-2026-87276.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.5, Oracle VM VirtualBox)
- [CVE-2026-87275](https://cve.now/CVE-2026-87275.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 4.6, Oracle VM VirtualBox)
- [CVE-2026-87274](https://cve.now/CVE-2026-87274.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 4.4, Oracle VM VirtualBox)
- [CVE-2026-87273](https://cve.now/CVE-2026-87273.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.6, Oracle VM VirtualBox)
- [CVE-2026-87272](https://cve.now/CVE-2026-87272.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.8, Oracle VM VirtualBox)
- [CVE-2026-87271](https://cve.now/CVE-2026-87271.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.8, Oracle VM VirtualBox)
- [CVE-2026-87270](https://cve.now/CVE-2026-87270.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.8, Oracle VM VirtualBox)
- [CVE-2026-87269](https://cve.now/CVE-2026-87269.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.8, Oracle VM VirtualBox)
- [CVE-2026-87268](https://cve.now/CVE-2026-87268.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.8, Oracle VM VirtualBox)
- [CVE-2026-87267](https://cve.now/CVE-2026-87267.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 5.3, Oracle VM VirtualBox)
- [CVE-2026-87266](https://cve.now/CVE-2026-87266.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). (CVSS 8.2, Oracle Agile PLM)
- [CVE-2026-87265](https://cve.now/CVE-2026-87265.md): Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). (CVSS 8.1, Oracle Purchasing)
- [CVE-2026-87264](https://cve.now/CVE-2026-87264.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). (CVSS 7.7, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2026-87262](https://cve.now/CVE-2026-87262.md): Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface (CVSS 7.1, Oracle Agile Engineering Data Management)
- [CVE-2026-87261](https://cve.now/CVE-2026-87261.md): Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface (CVSS 7.3, Oracle Agile Engineering Data Management)
- [CVE-2026-87260](https://cve.now/CVE-2026-87260.md): Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface (CVSS 7.3, Oracle Agile Engineering Data Management)
- [CVE-2026-87259](https://cve.now/CVE-2026-87259.md): Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface (CVSS 8.4, Oracle Agile Engineering Data Management)
- [CVE-2026-87258](https://cve.now/CVE-2026-87258.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). (CVSS 7.6, Oracle Agile PLM)
- [CVE-2026-87257](https://cve.now/CVE-2026-87257.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: SDK). (CVSS 7.7, Oracle Agile PLM)
- [CVE-2026-87256](https://cve.now/CVE-2026-87256.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). (CVSS 7.7, Oracle Agile PLM)
- [CVE-2026-87254](https://cve.now/CVE-2026-87254.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). (CVSS 7.5, Oracle Agile PLM)
- [CVE-2026-87253](https://cve.now/CVE-2026-87253.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Client). (CVSS 6.1, Oracle Agile PLM)
- [CVE-2026-87252](https://cve.now/CVE-2026-87252.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). (CVSS 6.8, Oracle Agile PLM)
- [CVE-2026-87250](https://cve.now/CVE-2026-87250.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.6, Oracle Hyperion Financial Management)
- [CVE-2026-87249](https://cve.now/CVE-2026-87249.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.1, Oracle Hyperion Financial Management)
- [CVE-2026-87248](https://cve.now/CVE-2026-87248.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 6.7, Oracle Hyperion Financial Management)
- [CVE-2026-87247](https://cve.now/CVE-2026-87247.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management)
- [CVE-2026-87246](https://cve.now/CVE-2026-87246.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.2, Oracle Hyperion Financial Management)
- [CVE-2026-87245](https://cve.now/CVE-2026-87245.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.0, Oracle Hyperion Financial Management)
- [CVE-2026-87244](https://cve.now/CVE-2026-87244.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.2, Oracle Hyperion Financial Management)
- [CVE-2026-87243](https://cve.now/CVE-2026-87243.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.0, Oracle Hyperion Financial Management)
- [CVE-2026-87242](https://cve.now/CVE-2026-87242.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.4, Oracle Hyperion Financial Management)
- [CVE-2026-87241](https://cve.now/CVE-2026-87241.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.1, Oracle Hyperion Financial Management)
- [CVE-2026-87240](https://cve.now/CVE-2026-87240.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.0, Oracle Hyperion Financial Management)
- [CVE-2026-87239](https://cve.now/CVE-2026-87239.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.2, Oracle Hyperion Financial Management)
- [CVE-2026-87238](https://cve.now/CVE-2026-87238.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management)
- [CVE-2026-87237](https://cve.now/CVE-2026-87237.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management)
- [CVE-2026-87236](https://cve.now/CVE-2026-87236.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.1, Oracle Hyperion Financial Management)
- [CVE-2026-87235](https://cve.now/CVE-2026-87235.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.4, Oracle Hyperion Financial Management)
- [CVE-2026-87234](https://cve.now/CVE-2026-87234.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.1, Oracle Hyperion Financial Management)
- [CVE-2026-87233](https://cve.now/CVE-2026-87233.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.6, Oracle Hyperion Financial Management)
- [CVE-2026-87232](https://cve.now/CVE-2026-87232.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.1, Oracle Hyperion Financial Management)
- [CVE-2026-87231](https://cve.now/CVE-2026-87231.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.1, Oracle Hyperion Financial Management)
- [CVE-2026-87230](https://cve.now/CVE-2026-87230.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 10.0, Oracle Hyperion Financial Management)
- [CVE-2026-87229](https://cve.now/CVE-2026-87229.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.2, Oracle Hyperion Financial Management)
- [CVE-2026-87228](https://cve.now/CVE-2026-87228.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.2, Oracle Hyperion Financial Management)
- [CVE-2026-87227](https://cve.now/CVE-2026-87227.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management)
- [CVE-2026-87226](https://cve.now/CVE-2026-87226.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management)
- [CVE-2026-87225](https://cve.now/CVE-2026-87225.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.1, Oracle Hyperion Financial Management)
- [CVE-2026-87224](https://cve.now/CVE-2026-87224.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management)
- [CVE-2026-87223](https://cve.now/CVE-2026-87223.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.1, Oracle Hyperion Financial Management)
- [CVE-2026-87222](https://cve.now/CVE-2026-87222.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management)
- [CVE-2026-87221](https://cve.now/CVE-2026-87221.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management)
- [CVE-2026-87220](https://cve.now/CVE-2026-87220.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.1, Oracle Hyperion Financial Management)
- [CVE-2026-87219](https://cve.now/CVE-2026-87219.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.4, Oracle Hyperion Financial Management)
- [CVE-2026-87218](https://cve.now/CVE-2026-87218.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.1, Oracle Hyperion Financial Management)
- [CVE-2026-87217](https://cve.now/CVE-2026-87217.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.1, Oracle Hyperion Financial Management)
- [CVE-2026-87216](https://cve.now/CVE-2026-87216.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.8, Oracle Hyperion Financial Management)
- [CVE-2026-87215](https://cve.now/CVE-2026-87215.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management)
- [CVE-2026-87214](https://cve.now/CVE-2026-87214.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.1, Oracle Hyperion Financial Management)
- [CVE-2026-87213](https://cve.now/CVE-2026-87213.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.4, Oracle Hyperion Financial Management)
- [CVE-2026-87212](https://cve.now/CVE-2026-87212.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.4, Oracle Hyperion Financial Management)
- [CVE-2026-87211](https://cve.now/CVE-2026-87211.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management)
- [CVE-2026-87210](https://cve.now/CVE-2026-87210.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.3, Oracle Hyperion Financial Management)
- [CVE-2026-87209](https://cve.now/CVE-2026-87209.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.1, Oracle Hyperion Financial Management)
- [CVE-2026-87208](https://cve.now/CVE-2026-87208.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.1, Oracle Hyperion Financial Management)
- [CVE-2026-87207](https://cve.now/CVE-2026-87207.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.2, Oracle Hyperion Financial Management)
- [CVE-2026-87206](https://cve.now/CVE-2026-87206.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.4, Oracle Hyperion Financial Management)
- [CVE-2026-87205](https://cve.now/CVE-2026-87205.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management)
- [CVE-2026-87204](https://cve.now/CVE-2026-87204.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management)
- [CVE-2026-87203](https://cve.now/CVE-2026-87203.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management)
- [CVE-2026-87202](https://cve.now/CVE-2026-87202.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management)
- [CVE-2026-87201](https://cve.now/CVE-2026-87201.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management)
- [CVE-2026-87200](https://cve.now/CVE-2026-87200.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.2, Oracle Hyperion Financial Management)
- [CVE-2026-87199](https://cve.now/CVE-2026-87199.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management)
- [CVE-2026-87198](https://cve.now/CVE-2026-87198.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.4, Oracle Hyperion Financial Management)
- [CVE-2026-87197](https://cve.now/CVE-2026-87197.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.2, Oracle Hyperion Financial Management)
- [CVE-2026-87196](https://cve.now/CVE-2026-87196.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.2, Oracle Hyperion Financial Management)
- [CVE-2026-87195](https://cve.now/CVE-2026-87195.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.4, Oracle Hyperion Financial Management)
- [CVE-2026-87194](https://cve.now/CVE-2026-87194.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management)
- [CVE-2026-87193](https://cve.now/CVE-2026-87193.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management)
- [CVE-2026-87192](https://cve.now/CVE-2026-87192.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.1, Oracle Hyperion Financial Management)
- [CVE-2026-87191](https://cve.now/CVE-2026-87191.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.1, Oracle Hyperion Financial Management)
- [CVE-2026-87190](https://cve.now/CVE-2026-87190.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.5, Oracle Hyperion Financial Management)
- [CVE-2026-87189](https://cve.now/CVE-2026-87189.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.1, Oracle Hyperion Financial Management)
- [CVE-2026-87188](https://cve.now/CVE-2026-87188.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.8, Oracle Hyperion Financial Management)
- [CVE-2026-87187](https://cve.now/CVE-2026-87187.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management)
- [CVE-2026-87186](https://cve.now/CVE-2026-87186.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.6, Oracle Hyperion Financial Management)
- [CVE-2026-87185](https://cve.now/CVE-2026-87185.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management)
- [CVE-2026-87184](https://cve.now/CVE-2026-87184.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.8, Oracle Hyperion Financial Management)
- [CVE-2026-87183](https://cve.now/CVE-2026-87183.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 7.7, Oracle Hyperion Financial Management)
- [CVE-2026-87182](https://cve.now/CVE-2026-87182.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management)
- [CVE-2026-87181](https://cve.now/CVE-2026-87181.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management)
- [CVE-2026-87180](https://cve.now/CVE-2026-87180.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management)
- [CVE-2026-87179](https://cve.now/CVE-2026-87179.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.8, Oracle Hyperion Financial Management)
- [CVE-2026-87178](https://cve.now/CVE-2026-87178.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.7, Oracle Hyperion Financial Management)
- [CVE-2026-87177](https://cve.now/CVE-2026-87177.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.5, Oracle Hyperion Financial Management)
- [CVE-2026-87176](https://cve.now/CVE-2026-87176.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.1, Oracle Hyperion Financial Management)
- [CVE-2026-87175](https://cve.now/CVE-2026-87175.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.1, Oracle Hyperion Financial Management)
- [CVE-2026-87174](https://cve.now/CVE-2026-87174.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.2, Oracle Hyperion Financial Management)
- [CVE-2026-87173](https://cve.now/CVE-2026-87173.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.1, Oracle Hyperion Financial Management)
- [CVE-2026-87172](https://cve.now/CVE-2026-87172.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.9, Oracle Hyperion Financial Management)
- [CVE-2026-87171](https://cve.now/CVE-2026-87171.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 8.7, Oracle Hyperion Financial Management)
- [CVE-2026-87170](https://cve.now/CVE-2026-87170.md): Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). (CVSS 9.1, Oracle Hyperion Financial Management)
- [CVE-2026-87169](https://cve.now/CVE-2026-87169.md): Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Wage Determinatio (CVSS 6.1, Oracle Contract Lifecycle Management for Public Sector)
- [CVE-2026-87168](https://cve.now/CVE-2026-87168.md): Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing). (CVSS 8.1, Oracle Purchasing)
- [CVE-2026-87167](https://cve.now/CVE-2026-87167.md): Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing). (CVSS 8.1, Oracle Purchasing)
- [CVE-2026-87166](https://cve.now/CVE-2026-87166.md): Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). (CVSS 8.1, Oracle Purchasing)
- [CVE-2026-87165](https://cve.now/CVE-2026-87165.md): Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: ECC For Award and (CVSS 8.8, Oracle Contract Lifecycle Management for Public Sector)
- [CVE-2026-87164](https://cve.now/CVE-2026-87164.md): Vulnerability in the Oracle Banking Branch product of Oracle Financial Services Applications (component: Reports). (CVSS 8.0, Oracle Banking Branch)
- [CVE-2026-87163](https://cve.now/CVE-2026-87163.md): Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue). (CVSS 8.8, Oracle Purchasing)
- [CVE-2026-87162](https://cve.now/CVE-2026-87162.md): Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). (CVSS 8.8, Oracle Contract Lifecycle Management for Public Sector)
- [CVE-2026-87161](https://cve.now/CVE-2026-87161.md): Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.5, Oracle HRMS)
- [CVE-2026-87160](https://cve.now/CVE-2026-87160.md): Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle HRMS)
- [CVE-2026-87159](https://cve.now/CVE-2026-87159.md): Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle HRMS)
- [CVE-2026-87158](https://cve.now/CVE-2026-87158.md): Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Enterprise Command Center). (CVSS 7.1, Oracle Order Management)
- [CVE-2026-87157](https://cve.now/CVE-2026-87157.md): Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). (CVSS 8.1, Oracle Order Management)
- [CVE-2026-87156](https://cve.now/CVE-2026-87156.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle Product Hub)
- [CVE-2026-87155](https://cve.now/CVE-2026-87155.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Product Hub)
- [CVE-2026-87154](https://cve.now/CVE-2026-87154.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Product Hub)
- [CVE-2026-87153](https://cve.now/CVE-2026-87153.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Product Hub)
- [CVE-2026-87152](https://cve.now/CVE-2026-87152.md): Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Create Item Instance). (CVSS 8.1, Oracle Installed Base)
- [CVE-2026-87151](https://cve.now/CVE-2026-87151.md): Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Setup Workbench). (CVSS 7.7, Oracle Bills of Material)
- [CVE-2026-87150](https://cve.now/CVE-2026-87150.md): Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Setup Workbench). (CVSS 8.8, Oracle Bills of Material)
- [CVE-2026-87149](https://cve.now/CVE-2026-87149.md): Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). (CVSS 7.1, Oracle Contract Lifecycle Management for Public Sector)
- [CVE-2026-87148](https://cve.now/CVE-2026-87148.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.5, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87147](https://cve.now/CVE-2026-87147.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.7, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87146](https://cve.now/CVE-2026-87146.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.1, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87145](https://cve.now/CVE-2026-87145.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.3, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87144](https://cve.now/CVE-2026-87144.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.6, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87143](https://cve.now/CVE-2026-87143.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.4, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87142](https://cve.now/CVE-2026-87142.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.1, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87141](https://cve.now/CVE-2026-87141.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.7, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87140](https://cve.now/CVE-2026-87140.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.5, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87139](https://cve.now/CVE-2026-87139.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.5, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87138](https://cve.now/CVE-2026-87138.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.5, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87137](https://cve.now/CVE-2026-87137.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.6, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87136](https://cve.now/CVE-2026-87136.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.5, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87135](https://cve.now/CVE-2026-87135.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.1, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87134](https://cve.now/CVE-2026-87134.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.7, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87133](https://cve.now/CVE-2026-87133.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.6, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87132](https://cve.now/CVE-2026-87132.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.6, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87131](https://cve.now/CVE-2026-87131.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.6, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87130](https://cve.now/CVE-2026-87130.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 7.4, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87129](https://cve.now/CVE-2026-87129.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 9.1, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87128](https://cve.now/CVE-2026-87128.md): Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). (CVSS 9.1, Oracle Hyperion Data Relationship Management)
- [CVE-2026-87127](https://cve.now/CVE-2026-87127.md): Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: G-Invoicing). (CVSS 7.7, Oracle Purchasing)
- [CVE-2026-87126](https://cve.now/CVE-2026-87126.md): Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Reports Security). (CVSS 7.1, Oracle Report Manager)
- [CVE-2026-87125](https://cve.now/CVE-2026-87125.md): Vulnerability in the Oracle Financials for Asia/Pacific product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.3, Oracle Financials for Asia/Pacific)
- [CVE-2026-87124](https://cve.now/CVE-2026-87124.md): Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.7, Oracle iRecruitment)
- [CVE-2026-83491](https://cve.now/CVE-2026-83491.md): Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations). (CVSS 6.8, Oracle iRecruitment)
- [CVE-2026-83490](https://cve.now/CVE-2026-83490.md): Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.5, Oracle iRecruitment)
- [CVE-2026-83489](https://cve.now/CVE-2026-83489.md): Vulnerability in the Oracle Banking Origination product of Oracle Financial Services Applications (component: Onboarding Batch Processes). (CVSS 7.5, Oracle Banking Origination)
- [CVE-2026-83488](https://cve.now/CVE-2026-83488.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security). (CVSS 5.4, Oracle Helidon)
- [CVE-2026-83487](https://cve.now/CVE-2026-83487.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). (CVSS 7.7, Oracle Product Hub)
- [CVE-2026-83486](https://cve.now/CVE-2026-83486.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). (CVSS 7.7, Oracle Product Hub)
- [CVE-2026-83485](https://cve.now/CVE-2026-83485.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Item Catalog). (CVSS 7.7, Oracle Product Hub)
- [CVE-2026-83484](https://cve.now/CVE-2026-83484.md): Vulnerability in the Oracle US Federal Human Resources product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle US Federal Human Resources)
- [CVE-2026-83483](https://cve.now/CVE-2026-83483.md): Vulnerability in the Oracle Advanced Benefits product of Oracle E-Business Suite (component: Self-serv What-if Analysis). (CVSS 8.0, Oracle Advanced Benefits)
- [CVE-2026-83482](https://cve.now/CVE-2026-83482.md): Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Contracts)
- [CVE-2026-83481](https://cve.now/CVE-2026-83481.md): Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Contracts)
- [CVE-2026-83480](https://cve.now/CVE-2026-83480.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket). (CVSS 5.3, Oracle Helidon)
- [CVE-2026-83479](https://cve.now/CVE-2026-83479.md): Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Contracts)
- [CVE-2026-83477](https://cve.now/CVE-2026-83477.md): Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Workbenches). (CVSS 8.1, Oracle Work in Process)
- [CVE-2026-83465](https://cve.now/CVE-2026-83465.md): Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). (CVSS 8.2, Oracle Mobile Application Server)
- [CVE-2026-83464](https://cve.now/CVE-2026-83464.md): Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). (CVSS 8.1, Oracle Mobile Application Server)
- [CVE-2026-83463](https://cve.now/CVE-2026-83463.md): Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). (CVSS 7.5, Oracle Mobile Application Server)
- [CVE-2026-83462](https://cve.now/CVE-2026-83462.md): Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). (CVSS 9.8, Oracle Mobile Application Server)
- [CVE-2026-83461](https://cve.now/CVE-2026-83461.md): Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). (CVSS 8.2, Oracle Mobile Application Server)
- [CVE-2026-83460](https://cve.now/CVE-2026-83460.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: LRA). (CVSS 6.5, Oracle Helidon)
- [CVE-2026-83459](https://cve.now/CVE-2026-83459.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-media-multipart). (CVSS 5.3, Oracle Helidon)
- [CVE-2026-83458](https://cve.now/CVE-2026-83458.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: JSON). (CVSS 5.3, Oracle Helidon)
- [CVE-2026-83457](https://cve.now/CVE-2026-83457.md): Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Demand Signal Repository)
- [CVE-2026-83456](https://cve.now/CVE-2026-83456.md): Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Demand Signal Repository)
- [CVE-2026-83455](https://cve.now/CVE-2026-83455.md): Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Demand Signal Repository)
- [CVE-2026-83454](https://cve.now/CVE-2026-83454.md): Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Document Management and Collaboration)
- [CVE-2026-83453](https://cve.now/CVE-2026-83453.md): Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Document Management and Collaboration)
- [CVE-2026-83452](https://cve.now/CVE-2026-83452.md): Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite (component: Internal Operations). (CVSS 9.8, Oracle Document Management and Collaboration)
- [CVE-2026-83451](https://cve.now/CVE-2026-83451.md): Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.5, Oracle Product Workbench)
- [CVE-2026-83450](https://cve.now/CVE-2026-83450.md): Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Setup Workbench). (CVSS 8.0, Oracle Bills of Material)
- [CVE-2026-83449](https://cve.now/CVE-2026-83449.md): Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.5, Oracle Bills of Material)
- [CVE-2026-83448](https://cve.now/CVE-2026-83448.md): Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Bills of Material)
- [CVE-2026-89027](https://cve.now/CVE-2026-89027.md): miniOrange JWT Authentication for WP REST APIs \< 4.8.0 Authentication Downgrade (CVSS 6.9, miniOrange JWT Authentication for WP REST APIs)
- [CVE-2026-83447](https://cve.now/CVE-2026-83447.md): Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Bills of Material)
- [CVE-2026-83446](https://cve.now/CVE-2026-83446.md): Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components). (CVSS 8.1, Oracle Financials Common Modules)
- [CVE-2026-83445](https://cve.now/CVE-2026-83445.md): Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Complex Maintenance, Repair and Overhaul)
- [CVE-2026-83444](https://cve.now/CVE-2026-83444.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Product Hub)
- [CVE-2026-83443](https://cve.now/CVE-2026-83443.md): Vulnerability in the Oracle Assets product of Oracle E-Business Suite (component: Internal Operations). (CVSS 6.5, Oracle Assets)
- [CVE-2026-83442](https://cve.now/CVE-2026-83442.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Product Hub)
- [CVE-2026-83441](https://cve.now/CVE-2026-83441.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 6.8, Oracle Product Hub)
- [CVE-2026-83440](https://cve.now/CVE-2026-83440.md): Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Product Hub)
- [CVE-2026-83439](https://cve.now/CVE-2026-83439.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-security-providers-idcs-mapper). (CVSS 8.1, Oracle Helidon)
- [CVE-2026-83438](https://cve.now/CVE-2026-83438.md): Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.2, Oracle Engineering)
- [CVE-2026-83437](https://cve.now/CVE-2026-83437.md): Vulnerability in the Oracle Engineering product of Oracle E-Business Suite (component: Change Management). (CVSS 7.7, Oracle Engineering)
- [CVE-2026-83436](https://cve.now/CVE-2026-83436.md): Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Recall Management). (CVSS 7.1, Oracle Depot Repair)
- [CVE-2026-83435](https://cve.now/CVE-2026-83435.md): Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.2, Oracle Bills of Material)
- [CVE-2026-83434](https://cve.now/CVE-2026-83434.md): Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Product Workbench)
- [CVE-2026-83433](https://cve.now/CVE-2026-83433.md): Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Depot Repair Diagnostics). (CVSS 6.5, Oracle Depot Repair)
- [CVE-2026-83432](https://cve.now/CVE-2026-83432.md): Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Estimate and Actual Charges). (CVSS 8.1, Oracle Depot Repair)
- [CVE-2026-83431](https://cve.now/CVE-2026-83431.md): Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: WebUI). (CVSS 5.4, Oracle Product Workbench)
- [CVE-2026-83430](https://cve.now/CVE-2026-83430.md): Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Product Workbench)
- [CVE-2026-83429](https://cve.now/CVE-2026-83429.md): Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Demand Signal Repository)
- [CVE-2026-83428](https://cve.now/CVE-2026-83428.md): Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Demand Signal Repository)
- [CVE-2026-83425](https://cve.now/CVE-2026-83425.md): Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.5, Oracle Complex Maintenance, Repair and Overhaul)
- [CVE-2026-83424](https://cve.now/CVE-2026-83424.md): Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). (CVSS 7.5, Oracle JDeveloper)
- [CVE-2026-83423](https://cve.now/CVE-2026-83423.md): Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Security Framework). (CVSS 8.8, Oracle JDeveloper)
- [CVE-2026-83422](https://cve.now/CVE-2026-83422.md): Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). (CVSS 8.1, Oracle Identity Manager)
- [CVE-2026-83420](https://cve.now/CVE-2026-83420.md): Vulnerability in the PeopleSoft Enterprise FIN Engineering Brazil product of Oracle PeopleSoft (component: Engineering). (CVSS 7.8, Oracle PeopleSoft Enterprise FIN Engineering Brazil)
- [CVE-2026-83419](https://cve.now/CVE-2026-83419.md): Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEP (CVSS 5.4, Oracle Communications Cloud Native Core Security Edge Prote…)
- [CVE-2026-83418](https://cve.now/CVE-2026-83418.md): Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEP (CVSS 8.2, Oracle Communications Cloud Native Core Security Edge Prote…)
- [CVE-2026-83417](https://cve.now/CVE-2026-83417.md): Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEP (CVSS 7.1, Oracle Communications Cloud Native Core Security Edge Prote…)
- [CVE-2026-83416](https://cve.now/CVE-2026-83416.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 4.3, Oracle Coherence)
- [CVE-2026-83415](https://cve.now/CVE-2026-83415.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle Coherence)
- [CVE-2026-83414](https://cve.now/CVE-2026-83414.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 2.5, Oracle Coherence)
- [CVE-2026-83413](https://cve.now/CVE-2026-83413.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 1.9, Oracle Coherence)
- [CVE-2026-83412](https://cve.now/CVE-2026-83412.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 8.1, Oracle Coherence)
- [CVE-2026-83411](https://cve.now/CVE-2026-83411.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 8.8, Oracle Coherence)
- [CVE-2026-83410](https://cve.now/CVE-2026-83410.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 8.8, Oracle Coherence)
- [CVE-2026-83369](https://cve.now/CVE-2026-83369.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Access SDK). (CVSS 3.1, Oracle Access Manager)
- [CVE-2026-83356](https://cve.now/CVE-2026-83356.md): Vulnerability in the Enterprise Command Center Framework product of Oracle E-Business Suite (component: Security). (CVSS 7.7, Oracle Enterprise Command Center Framework)
- [CVE-2026-83355](https://cve.now/CVE-2026-83355.md): Vulnerability in the Oracle Enterprise Manager for Fusion Middleware product of Oracle Enterprise Manager (component: Metrics). (CVSS 9.8, Oracle Enterprise Manager for Fusion Middleware)
- [CVE-2026-83354](https://cve.now/CVE-2026-83354.md): Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). (CVSS 6.3, Oracle Coherence)
- [CVE-2026-83353](https://cve.now/CVE-2026-83353.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 7.8, Oracle WebCenter Content)
- [CVE-2026-83352](https://cve.now/CVE-2026-83352.md): Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). (CVSS 7.1, Oracle XML Gateway)
- [CVE-2026-83351](https://cve.now/CVE-2026-83351.md): Vulnerability in the RDBMS component of Oracle Database Server. (CVSS 8.1, Oracle Database Server)
- [CVE-2026-83350](https://cve.now/CVE-2026-83350.md): Vulnerability in the Oracle Net Services component of Oracle Database Server. (CVSS 7.5, Oracle Database Server)
- [CVE-2026-83349](https://cve.now/CVE-2026-83349.md): Vulnerability in the Oracle Net Services component of Oracle Database Server. (CVSS 7.5, Oracle Database Server)
- [CVE-2026-83348](https://cve.now/CVE-2026-83348.md): Vulnerability in the RDBMS component of Oracle Database Server. (CVSS 8.8, Oracle Database Server)
- [CVE-2026-83347](https://cve.now/CVE-2026-83347.md): Vulnerability in the Oracle Net Services component of Oracle Database Server. (CVSS 6.5, Oracle Database Server)
- [CVE-2026-83346](https://cve.now/CVE-2026-83346.md): Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware (component: Framework). (CVSS 5.4, Oracle Fusion Middleware Control)
- [CVE-2026-83345](https://cve.now/CVE-2026-83345.md): Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). (CVSS 7.1, Oracle XML Gateway)
- [CVE-2026-83344](https://cve.now/CVE-2026-83344.md): Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Database Application Table). (CVSS 7.2, Oracle Identity Manager Connector)
- [CVE-2026-83343](https://cve.now/CVE-2026-83343.md): Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide). (CVSS 8.2, Oracle Utilities Network Management System)
- [CVE-2026-83342](https://cve.now/CVE-2026-83342.md): Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: System Wide). (CVSS 7.8, Oracle Utilities Network Management System)
- [CVE-2026-83341](https://cve.now/CVE-2026-83341.md): Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). (CVSS 7.5, Oracle Applications Manager)
- [CVE-2026-83340](https://cve.now/CVE-2026-83340.md): Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Security). (CVSS 8.8, Oracle Identity Manager)
- [CVE-2026-83339](https://cve.now/CVE-2026-83339.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 9.8, Oracle WebCenter Enterprise Capture)
- [CVE-2026-83338](https://cve.now/CVE-2026-83338.md): Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). (CVSS 8.8, Oracle Applications Manager)
- [CVE-2026-83337](https://cve.now/CVE-2026-83337.md): Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Remote Diagnostic Agent). (CVSS 7.8, Oracle Middleware Common Libraries and Tools)
- [CVE-2026-83336](https://cve.now/CVE-2026-83336.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). (CVSS 7.8, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83335](https://cve.now/CVE-2026-83335.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). (CVSS 8.8, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83334](https://cve.now/CVE-2026-83334.md): Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security). (CVSS 7.4, Oracle Web Services Manager)
- [CVE-2026-83333](https://cve.now/CVE-2026-83333.md): Vulnerability in the Oracle Net Services component of Oracle Database Server. (CVSS 7.5, Oracle Database Server)
- [CVE-2026-83332](https://cve.now/CVE-2026-83332.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). (CVSS 7.1, Oracle Applications Framework)
- [CVE-2026-83331](https://cve.now/CVE-2026-83331.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). (CVSS 8.8, Oracle Applications Framework)
- [CVE-2026-83330](https://cve.now/CVE-2026-83330.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: WebSocket). (CVSS 7.5, Oracle Helidon)
- [CVE-2026-83329](https://cve.now/CVE-2026-83329.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). (CVSS 8.8, Oracle Applications Framework)
- [CVE-2026-83328](https://cve.now/CVE-2026-83328.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). (CVSS 7.2, Oracle Applications Framework)
- [CVE-2026-83327](https://cve.now/CVE-2026-83327.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). (CVSS 9.8, Oracle Applications Framework)
- [CVE-2026-83326](https://cve.now/CVE-2026-83326.md): Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration). (CVSS 7.5, Oracle Siebel CRM Integration)
- [CVE-2026-83325](https://cve.now/CVE-2026-83325.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.2, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83324](https://cve.now/CVE-2026-83324.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). (CVSS 7.1, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83323](https://cve.now/CVE-2026-83323.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.5, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83322](https://cve.now/CVE-2026-83322.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.2, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83321](https://cve.now/CVE-2026-83321.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Actions). (CVSS 8.5, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83320](https://cve.now/CVE-2026-83320.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Administration). (CVSS 7.6, Oracle BI Publisher)
- [CVE-2026-89040](https://cve.now/CVE-2026-89040.md): Tencent Mass Service Engine in Cluster (MSEC) path traversal (CVSS 9.8, Tencent Mass Service Engine in Cluster)
- [CVE-2026-83319](https://cve.now/CVE-2026-83319.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). (CVSS 7.7, Oracle BI Publisher)
- [CVE-2026-83318](https://cve.now/CVE-2026-83318.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Administration). (CVSS 7.5, Oracle BI Publisher)
- [CVE-2026-83317](https://cve.now/CVE-2026-83317.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Installation). (CVSS 7.8, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83316](https://cve.now/CVE-2026-83316.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.0, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83315](https://cve.now/CVE-2026-83315.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.8, Oracle BI Publisher)
- [CVE-2026-83314](https://cve.now/CVE-2026-83314.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). (CVSS 8.1, Oracle BI Publisher)
- [CVE-2026-83313](https://cve.now/CVE-2026-83313.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 7.7, Oracle BI Publisher)
- [CVE-2026-83312](https://cve.now/CVE-2026-83312.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: E-Business Suite - XDO). (CVSS 7.7, Oracle BI Publisher)
- [CVE-2026-83311](https://cve.now/CVE-2026-83311.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.5, Oracle BI Publisher)
- [CVE-2026-83310](https://cve.now/CVE-2026-83310.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.7, Oracle BI Publisher)
- [CVE-2026-83309](https://cve.now/CVE-2026-83309.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). (CVSS 8.5, Oracle BI Publisher)
- [CVE-2026-83308](https://cve.now/CVE-2026-83308.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.1, Oracle BI Publisher)
- [CVE-2026-83307](https://cve.now/CVE-2026-83307.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.3, Oracle BI Publisher)
- [CVE-2026-83306](https://cve.now/CVE-2026-83306.md): Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Resource Catalog Services). (CVSS 8.8, Oracle JDeveloper)
- [CVE-2026-83305](https://cve.now/CVE-2026-83305.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.6, Oracle BI Publisher)
- [CVE-2026-83304](https://cve.now/CVE-2026-83304.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). (CVSS 8.9, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83303](https://cve.now/CVE-2026-83303.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.5, Oracle BI Publisher)
- [CVE-2026-83302](https://cve.now/CVE-2026-83302.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security). (CVSS 8.5, Oracle BI Publisher)
- [CVE-2026-83301](https://cve.now/CVE-2026-83301.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Service Administration UI). (CVSS 8.8, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83300](https://cve.now/CVE-2026-83300.md): Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). (CVSS 7.1, Oracle XML Gateway)
- [CVE-2026-83299](https://cve.now/CVE-2026-83299.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). (CVSS 8.1, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83298](https://cve.now/CVE-2026-83298.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 7.2, Oracle BI Publisher)
- [CVE-2026-83297](https://cve.now/CVE-2026-83297.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.1, Oracle BI Publisher)
- [CVE-2026-83296](https://cve.now/CVE-2026-83296.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). (CVSS 7.5, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83295](https://cve.now/CVE-2026-83295.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). (CVSS 7.5, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83294](https://cve.now/CVE-2026-83294.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.8, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83293](https://cve.now/CVE-2026-83293.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: FNDN). (CVSS 7.8, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83292](https://cve.now/CVE-2026-83292.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.5, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83291](https://cve.now/CVE-2026-83291.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.8, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83290](https://cve.now/CVE-2026-83290.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.8, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83289](https://cve.now/CVE-2026-83289.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). (CVSS 7.5, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83288](https://cve.now/CVE-2026-83288.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). (CVSS 7.8, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83287](https://cve.now/CVE-2026-83287.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). (CVSS 7.7, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83286](https://cve.now/CVE-2026-83286.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 8.1, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83285](https://cve.now/CVE-2026-83285.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). (CVSS 8.3, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83284](https://cve.now/CVE-2026-83284.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 8.6, Oracle BI Publisher)
- [CVE-2026-83283](https://cve.now/CVE-2026-83283.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 9.8, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83282](https://cve.now/CVE-2026-83282.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 9.9, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83281](https://cve.now/CVE-2026-83281.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver). (CVSS 7.5, Oracle Helidon)
- [CVE-2026-83280](https://cve.now/CVE-2026-83280.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webserver-http2). (CVSS 7.5, Oracle Helidon)
- [CVE-2026-83279](https://cve.now/CVE-2026-83279.md): Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). (CVSS 5.5, Oracle Agile PLM MCAD Connector)
- [CVE-2026-83278](https://cve.now/CVE-2026-83278.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-integrations-neo4j). (CVSS 6.8, Oracle Helidon)
- [CVE-2026-83277](https://cve.now/CVE-2026-83277.md): Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). (CVSS 7.3, Oracle Agile PLM MCAD Connector)
- [CVE-2026-83276](https://cve.now/CVE-2026-83276.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2). (CVSS 7.5, Oracle Helidon)
- [CVE-2026-83274](https://cve.now/CVE-2026-83274.md): Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). (CVSS 5.5, Oracle Agile PLM MCAD Connector)
- [CVE-2026-76796](https://cve.now/CVE-2026-76796.md): Newell Brands DYMO Connect Desktop improper file path validation (CVSS 4.0, Newell Brands DYMO Connect Desktop)
- [CVE-2026-83273](https://cve.now/CVE-2026-83273.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). (CVSS 7.2, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83272](https://cve.now/CVE-2026-83272.md): Vulnerability in the Oracle Text component of Oracle Database Server. (CVSS 8.5, Oracle Database Server)
- [CVE-2026-83271](https://cve.now/CVE-2026-83271.md): Vulnerability in the RDBMS component of Oracle Database Server. (CVSS 8.8, Oracle Database Server)
- [CVE-2026-83270](https://cve.now/CVE-2026-83270.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). (CVSS 7.5, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83269](https://cve.now/CVE-2026-83269.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 9.8, Oracle BI Publisher)
- [CVE-2026-83268](https://cve.now/CVE-2026-83268.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). (CVSS 9.1, Oracle BI Publisher)
- [CVE-2026-83267](https://cve.now/CVE-2026-83267.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security). (CVSS 8.5, Oracle BI Publisher)
- [CVE-2026-83266](https://cve.now/CVE-2026-83266.md): Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Resource Catalog Services). (CVSS 8.2, Oracle JDeveloper)
- [CVE-2026-83265](https://cve.now/CVE-2026-83265.md): Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Agent). (CVSS 8.2, Oracle Web Services Manager)
- [CVE-2026-83264](https://cve.now/CVE-2026-83264.md): Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). (CVSS 8.4, Oracle Product Lifecycle Analytics)
- [CVE-2026-83263](https://cve.now/CVE-2026-83263.md): Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). (CVSS 7.5, Oracle Product Lifecycle Analytics)
- [CVE-2026-83262](https://cve.now/CVE-2026-83262.md): Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). (CVSS 7.5, Oracle Product Lifecycle Analytics)
- [CVE-2026-83261](https://cve.now/CVE-2026-83261.md): Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Core). (CVSS 9.8, Oracle Product Lifecycle Analytics)
- [CVE-2026-83260](https://cve.now/CVE-2026-83260.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Event Java PX). (CVSS 9.1, Oracle Agile PLM)
- [CVE-2026-83259](https://cve.now/CVE-2026-83259.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.1, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83258](https://cve.now/CVE-2026-83258.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 8.1, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83257](https://cve.now/CVE-2026-83257.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.5, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83256](https://cve.now/CVE-2026-83256.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 8.1, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83255](https://cve.now/CVE-2026-83255.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 8.1, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83254](https://cve.now/CVE-2026-83254.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 8.1, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83253](https://cve.now/CVE-2026-83253.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Applic (CVSS 7.8, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83252](https://cve.now/CVE-2026-83252.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.0, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83251](https://cve.now/CVE-2026-83251.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 6.5, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83250](https://cve.now/CVE-2026-83250.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 6.5, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83249](https://cve.now/CVE-2026-83249.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.8, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83248](https://cve.now/CVE-2026-83248.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 8.2, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83247](https://cve.now/CVE-2026-83247.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.8, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83246](https://cve.now/CVE-2026-83246.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 8.1, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83245](https://cve.now/CVE-2026-83245.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 8.1, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83244](https://cve.now/CVE-2026-83244.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.1, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83243](https://cve.now/CVE-2026-83243.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Ma (CVSS 7.7, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83242](https://cve.now/CVE-2026-83242.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Ma (CVSS 7.3, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83241](https://cve.now/CVE-2026-83241.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.5, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83240](https://cve.now/CVE-2026-83240.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.1, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83239](https://cve.now/CVE-2026-83239.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Applic (CVSS 7.0, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83238](https://cve.now/CVE-2026-83238.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.1, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83237](https://cve.now/CVE-2026-83237.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). (CVSS 7.1, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83236](https://cve.now/CVE-2026-83236.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Ma (CVSS 8.2, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83235](https://cve.now/CVE-2026-83235.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Ma (CVSS 7.5, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83234](https://cve.now/CVE-2026-83234.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Ma (CVSS 8.2, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83233](https://cve.now/CVE-2026-83233.md): Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Ma (CVSS 7.7, Oracle Commerce Guided Search / Oracle Commerce Experience…)
- [CVE-2026-83232](https://cve.now/CVE-2026-83232.md): Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Console / Repository Explorer). (CVSS 9.8, Oracle Data Integrator)
- [CVE-2026-83231](https://cve.now/CVE-2026-83231.md): Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-dbclient-mongodb). (CVSS 7.0, Oracle Helidon)
- [CVE-2026-83230](https://cve.now/CVE-2026-83230.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel Management Console). (CVSS 7.1, Oracle Siebel CRM Deployment)
- [CVE-2026-83229](https://cve.now/CVE-2026-83229.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel Management Console). (CVSS 9.1, Oracle Siebel CRM Deployment)
- [CVE-2026-83228](https://cve.now/CVE-2026-83228.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.5, Oracle Siebel CRM Deployment)
- [CVE-2026-83227](https://cve.now/CVE-2026-83227.md): Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). (CVSS 7.5, Oracle Siebel CRM Integration)
- [CVE-2026-83226](https://cve.now/CVE-2026-83226.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.5, Oracle Siebel CRM Deployment)
- [CVE-2026-83225](https://cve.now/CVE-2026-83225.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.5, Oracle Siebel CRM Deployment)
- [CVE-2026-83224](https://cve.now/CVE-2026-83224.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.1, Oracle Siebel CRM Deployment)
- [CVE-2026-83223](https://cve.now/CVE-2026-83223.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Siebel Remote). (CVSS 7.5, Oracle Siebel CRM Deployment)
- [CVE-2026-83222](https://cve.now/CVE-2026-83222.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.5, Oracle Siebel CRM Deployment)
- [CVE-2026-83221](https://cve.now/CVE-2026-83221.md): Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). (CVSS 7.1, Oracle Siebel CRM Integration)
- [CVE-2026-83220](https://cve.now/CVE-2026-83220.md): Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Event Publish and Subscribe). (CVSS 8.1, Oracle Siebel CRM Integration)
- [CVE-2026-83219](https://cve.now/CVE-2026-83219.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.1, Oracle Siebel CRM Deployment)
- [CVE-2026-83218](https://cve.now/CVE-2026-83218.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.4, Oracle Siebel CRM Deployment)
- [CVE-2026-83217](https://cve.now/CVE-2026-83217.md): Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). (CVSS 7.1, Oracle Siebel CRM End User)
- [CVE-2026-83216](https://cve.now/CVE-2026-83216.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.8, Oracle Siebel CRM Deployment)
- [CVE-2026-83215](https://cve.now/CVE-2026-83215.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 8.2, Oracle Siebel CRM Deployment)
- [CVE-2026-83214](https://cve.now/CVE-2026-83214.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.8, Oracle Siebel CRM Deployment)
- [CVE-2026-83213](https://cve.now/CVE-2026-83213.md): Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Reports). (CVSS 7.5, Oracle Siebel CRM End User)
- [CVE-2026-83212](https://cve.now/CVE-2026-83212.md): Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component: Helpdesk/Training). (CVSS 8.8, Oracle Siebel Apps - Self Service)
- [CVE-2026-83211](https://cve.now/CVE-2026-83211.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.8, Oracle Siebel CRM Deployment)
- [CVE-2026-83210](https://cve.now/CVE-2026-83210.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 8.8, Oracle Siebel CRM Deployment)
- [CVE-2026-83209](https://cve.now/CVE-2026-83209.md): Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workflow). (CVSS 8.8, Oracle Siebel CRM Development)
- [CVE-2026-83208](https://cve.now/CVE-2026-83208.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Migration). (CVSS 8.8, Oracle Siebel CRM Deployment)
- [CVE-2026-83207](https://cve.now/CVE-2026-83207.md): Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Integration - Scripting). (CVSS 7.6, Oracle Siebel CRM Development)
- [CVE-2026-83206](https://cve.now/CVE-2026-83206.md): Vulnerability in the Oracle Banking Corporate Lending Process Management product of Oracle Financial Services Applications (component: Base) (CVSS 7.1, Oracle Banking Corporate Lending Process Management)
- [CVE-2026-83205](https://cve.now/CVE-2026-83205.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). (CVSS 8.8, Oracle Applications Framework)
- [CVE-2026-83204](https://cve.now/CVE-2026-83204.md): Vulnerability in the Oracle Sourcing product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.5, Oracle Sourcing)
- [CVE-2026-83203](https://cve.now/CVE-2026-83203.md): Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). (CVSS 8.6, Oracle Siebel CRM End User)
- [CVE-2026-83202](https://cve.now/CVE-2026-83202.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 9.1, Oracle Siebel CRM Deployment)
- [CVE-2026-83201](https://cve.now/CVE-2026-83201.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 9.1, Oracle Siebel CRM Deployment)
- [CVE-2026-83200](https://cve.now/CVE-2026-83200.md): Vulnerability in the Oracle Process Manufacturing Intelligence product of Oracle E-Business Suite (component: Internal Operations). (CVSS 6.5, Oracle Process Manufacturing Intelligence)
- [CVE-2026-83199](https://cve.now/CVE-2026-83199.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 8.8, Oracle Siebel CRM Deployment)
- [CVE-2026-83198](https://cve.now/CVE-2026-83198.md): Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). (CVSS 5.4, Oracle Field Service)
- [CVE-2026-83197](https://cve.now/CVE-2026-83197.md): Vulnerability in the Siebel Apps - Financial Services product of Oracle Siebel CRM (component: Financial Accounts). (CVSS 9.1, Oracle Siebel Apps - Financial Services)
- [CVE-2026-83196](https://cve.now/CVE-2026-83196.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 9.1, Oracle Siebel CRM Deployment)
- [CVE-2026-83195](https://cve.now/CVE-2026-83195.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.2, Oracle Siebel CRM Deployment)
- [CVE-2026-83194](https://cve.now/CVE-2026-83194.md): Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Depot Repair)
- [CVE-2026-83193](https://cve.now/CVE-2026-83193.md): Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: Life Sciences). (CVSS 7.3, Oracle Siebel Apps - Life Sciences)
- [CVE-2026-83192](https://cve.now/CVE-2026-83192.md): Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). (CVSS 8.1, Oracle Siebel CRM End User)
- [CVE-2026-83191](https://cve.now/CVE-2026-83191.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 8.1, Oracle Siebel CRM Deployment)
- [CVE-2026-83190](https://cve.now/CVE-2026-83190.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.3, Oracle Siebel CRM Deployment)
- [CVE-2026-83189](https://cve.now/CVE-2026-83189.md): Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Proxy User Delegation). (CVSS 8.8, Oracle User Management)
- [CVE-2026-83188](https://cve.now/CVE-2026-83188.md): Vulnerability in the Oracle Depot Repair product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Depot Repair)
- [CVE-2026-83187](https://cve.now/CVE-2026-83187.md): Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Applications Calendar). (CVSS 7.1, Oracle Common Applications Calendar)
- [CVE-2026-83186](https://cve.now/CVE-2026-83186.md): Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Applications Calendar). (CVSS 7.1, Oracle Common Applications Calendar)
- [CVE-2026-83185](https://cve.now/CVE-2026-83185.md): Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). (CVSS 7.3, Oracle Common Applications)
- [CVE-2026-83184](https://cve.now/CVE-2026-83184.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). (CVSS 7.4, Oracle Application Object Library)
- [CVE-2026-83183](https://cve.now/CVE-2026-83183.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.5, Oracle Siebel CRM Deployment)
- [CVE-2026-83182](https://cve.now/CVE-2026-83182.md): Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Configuration Tools). (CVSS 7.5, Oracle Siebel CRM Development)
- [CVE-2026-83181](https://cve.now/CVE-2026-83181.md): Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM (component: Workspaces). (CVSS 8.2, Oracle Siebel CRM Development)
- [CVE-2026-83180](https://cve.now/CVE-2026-83180.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 8.8, Oracle Siebel CRM Deployment)
- [CVE-2026-83179](https://cve.now/CVE-2026-83179.md): Vulnerability in the Oracle Common Applications Calendar product of Oracle E-Business Suite (component: Applications Calendar). (CVSS 7.1, Oracle Common Applications Calendar)
- [CVE-2026-83178](https://cve.now/CVE-2026-83178.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). (CVSS 8.0, Oracle Application Object Library)
- [CVE-2026-83177](https://cve.now/CVE-2026-83177.md): Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). (CVSS 8.1, Oracle One-to-One Fulfillment)
- [CVE-2026-83176](https://cve.now/CVE-2026-83176.md): Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). (CVSS 7.2, Oracle Common Applications)
- [CVE-2026-83175](https://cve.now/CVE-2026-83175.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). (CVSS 6.5, Oracle Application Object Library)
- [CVE-2026-83174](https://cve.now/CVE-2026-83174.md): Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Application Framework). (CVSS 8.1, Oracle CRM Technical Foundation)
- [CVE-2026-83173](https://cve.now/CVE-2026-83173.md): Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). (CVSS 7.1, Oracle One-to-One Fulfillment)
- [CVE-2026-83172](https://cve.now/CVE-2026-83172.md): Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: OSO Other). (CVSS 8.5, Oracle Sales Online)
- [CVE-2026-83171](https://cve.now/CVE-2026-83171.md): Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). (CVSS 7.1, Oracle One-to-One Fulfillment)
- [CVE-2026-83170](https://cve.now/CVE-2026-83170.md): Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents). (CVSS 8.0, Oracle One-to-One Fulfillment)
- [CVE-2026-83169](https://cve.now/CVE-2026-83169.md): Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Java Server Issues). (CVSS 8.1, Oracle One-to-One Fulfillment)
- [CVE-2026-83168](https://cve.now/CVE-2026-83168.md): Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). (CVSS 8.8, Oracle Applications Manager)
- [CVE-2026-83167](https://cve.now/CVE-2026-83167.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). (CVSS 7.5, Oracle Application Object Library)
- [CVE-2026-83166](https://cve.now/CVE-2026-83166.md): Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). (CVSS 7.7, Oracle Customer Interaction History)
- [CVE-2026-83165](https://cve.now/CVE-2026-83165.md): Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: User Interface). (CVSS 8.8, Oracle Customer Interaction History)
- [CVE-2026-83164](https://cve.now/CVE-2026-83164.md): Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). (CVSS 8.8, Oracle Customer Interaction History)
- [CVE-2026-83163](https://cve.now/CVE-2026-83163.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Attachments / File Upload). (CVSS 8.8, Oracle Application Object Library)
- [CVE-2026-83162](https://cve.now/CVE-2026-83162.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). (CVSS 7.4, Oracle Application Object Library)
- [CVE-2026-83161](https://cve.now/CVE-2026-83161.md): Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle Project Intelligence)
- [CVE-2026-83160](https://cve.now/CVE-2026-83160.md): Vulnerability in the RDBMS component of Oracle Database Server. (CVSS 8.8, Oracle Database Server)
- [CVE-2026-83159](https://cve.now/CVE-2026-83159.md): Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: ADPatch). (CVSS 7.8, Oracle Applications DBA)
- [CVE-2026-83158](https://cve.now/CVE-2026-83158.md): Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). (CVSS 7.1, Oracle Applications Manager)
- [CVE-2026-83157](https://cve.now/CVE-2026-83157.md): Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). (CVSS 8.0, Oracle Applications Manager)
- [CVE-2026-83156](https://cve.now/CVE-2026-83156.md): Vulnerability in the Oracle XML Developers Kit component of Oracle Database Server. (CVSS 7.5, Oracle Database Server)
- [CVE-2026-83155](https://cve.now/CVE-2026-83155.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 7.3, Oracle Siebel CRM Deployment)
- [CVE-2026-83154](https://cve.now/CVE-2026-83154.md): Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). (CVSS 9.1, Oracle Siebel CRM End User)
- [CVE-2026-83153](https://cve.now/CVE-2026-83153.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). (CVSS 8.8, Oracle Siebel CRM Deployment)
- [CVE-2026-83152](https://cve.now/CVE-2026-83152.md): Vulnerability in the Oracle Project Intelligence product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Project Intelligence)
- [CVE-2026-83151](https://cve.now/CVE-2026-83151.md): Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). (CVSS 9.8, Oracle Service Delivery Platform)
- [CVE-2026-83150](https://cve.now/CVE-2026-83150.md): Vulnerability in Oracle Application Testing Suite. (CVSS 7.0, Oracle Application Testing Suite)
- [CVE-2026-83149](https://cve.now/CVE-2026-83149.md): Vulnerability in Oracle Application Testing Suite. (CVSS 9.1, Oracle Application Testing Suite)
- [CVE-2026-83148](https://cve.now/CVE-2026-83148.md): Vulnerability in Oracle Application Testing Suite. (CVSS 8.8, Oracle Application Testing Suite)
- [CVE-2026-83147](https://cve.now/CVE-2026-83147.md): Vulnerability in the PeopleSoft Enterprise FIN Inventory Brazil product of Oracle PeopleSoft (component: Inventory). (CVSS 7.8, Oracle PeopleSoft Enterprise FIN Inventory Brazil)
- [CVE-2026-83146](https://cve.now/CVE-2026-83146.md): Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). (CVSS 7.7, Oracle Siebel CRM End User)
- [CVE-2026-83145](https://cve.now/CVE-2026-83145.md): Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM (component: Order Management). (CVSS 8.7, Oracle Siebel Apps - Customer Order Management)
- [CVE-2026-83144](https://cve.now/CVE-2026-83144.md): Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM (component: Order Management). (CVSS 8.7, Oracle Siebel Apps - Customer Order Management)
- [CVE-2026-83143](https://cve.now/CVE-2026-83143.md): Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing). (CVSS 8.1, Oracle Siebel Apps - Life Sciences)
- [CVE-2026-83142](https://cve.now/CVE-2026-83142.md): Vulnerability in the Oracle Proposals product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.7, Oracle Proposals)
- [CVE-2026-83141](https://cve.now/CVE-2026-83141.md): Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.7, Oracle Field Service)
- [CVE-2026-83140](https://cve.now/CVE-2026-83140.md): Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). (CVSS 6.5, Oracle Field Service)
- [CVE-2026-83138](https://cve.now/CVE-2026-83138.md): Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.0, Oracle Spares Management)
- [CVE-2026-83137](https://cve.now/CVE-2026-83137.md): Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Spares Management)
- [CVE-2026-83136](https://cve.now/CVE-2026-83136.md): Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Spares Management)
- [CVE-2026-83135](https://cve.now/CVE-2026-83135.md): Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). (CVSS 8.7, Oracle iStore)
- [CVE-2026-83134](https://cve.now/CVE-2026-83134.md): Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). (CVSS 7.7, Oracle iStore)
- [CVE-2026-83133](https://cve.now/CVE-2026-83133.md): Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). (CVSS 7.5, Oracle iStore)
- [CVE-2026-83132](https://cve.now/CVE-2026-83132.md): Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: Shopping Cart). (CVSS 8.1, Oracle iStore)
- [CVE-2026-83131](https://cve.now/CVE-2026-83131.md): Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File download). (CVSS 7.7, Oracle Web Applications Desktop Integrator)
- [CVE-2026-83130](https://cve.now/CVE-2026-83130.md): Vulnerability in the Oracle Site Hub product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle Site Hub)
- [CVE-2026-83129](https://cve.now/CVE-2026-83129.md): Vulnerability in the Oracle Sales product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.7, Oracle Sales)
- [CVE-2026-83128](https://cve.now/CVE-2026-83128.md): Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.5, Oracle Sales Offline)
- [CVE-2026-83127](https://cve.now/CVE-2026-83127.md): Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.7, Oracle Sales Offline)
- [CVE-2026-83126](https://cve.now/CVE-2026-83126.md): Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.6, Oracle Sales Online)
- [CVE-2026-83125](https://cve.now/CVE-2026-83125.md): Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Report Manager)
- [CVE-2026-83124](https://cve.now/CVE-2026-83124.md): Vulnerability in the Oracle Sales Online product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Sales Online)
- [CVE-2026-83123](https://cve.now/CVE-2026-83123.md): Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle Report Manager)
- [CVE-2026-83122](https://cve.now/CVE-2026-83122.md): Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Report Manager)
- [CVE-2026-83121](https://cve.now/CVE-2026-83121.md): Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). (CVSS 8.8, Oracle Marketing)
- [CVE-2026-83120](https://cve.now/CVE-2026-83120.md): Vulnerability in the Oracle Alert product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Alert)
- [CVE-2026-83119](https://cve.now/CVE-2026-83119.md): Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle User Management)
- [CVE-2026-83118](https://cve.now/CVE-2026-83118.md): Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). (CVSS 7.8, Oracle Applications DBA)
- [CVE-2026-83117](https://cve.now/CVE-2026-83117.md): Vulnerability in the Applications DBA product of Oracle E-Business Suite (component: AD Utilities). (CVSS 7.2, Oracle Applications DBA)
- [CVE-2026-83116](https://cve.now/CVE-2026-83116.md): Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). (CVSS 7.7, Oracle Order Management)
- [CVE-2026-83115](https://cve.now/CVE-2026-83115.md): Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Command Line - RapidClone). (CVSS 7.5, Oracle Applications Manager)
- [CVE-2026-83114](https://cve.now/CVE-2026-83114.md): Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.5, Oracle Quality)
- [CVE-2026-83113](https://cve.now/CVE-2026-83113.md): Vulnerability in the Oracle Quality product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle Quality)
- [CVE-2026-83112](https://cve.now/CVE-2026-83112.md): Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.2, Oracle Lease and Finance Management)
- [CVE-2026-83111](https://cve.now/CVE-2026-83111.md): Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle Partner Management)
- [CVE-2026-83110](https://cve.now/CVE-2026-83110.md): Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). (CVSS 7.5, Oracle Marketing)
- [CVE-2026-83109](https://cve.now/CVE-2026-83109.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 5.3, Oracle Forms)
- [CVE-2026-83108](https://cve.now/CVE-2026-83108.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.8, Oracle Forms)
- [CVE-2026-83107](https://cve.now/CVE-2026-83107.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.1, Oracle Forms)
- [CVE-2026-83106](https://cve.now/CVE-2026-83106.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 7.5, Oracle Forms)
- [CVE-2026-83105](https://cve.now/CVE-2026-83105.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.0, Oracle Forms)
- [CVE-2026-83104](https://cve.now/CVE-2026-83104.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.1, Oracle Forms)
- [CVE-2026-83103](https://cve.now/CVE-2026-83103.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.1, Oracle Forms)
- [CVE-2026-83102](https://cve.now/CVE-2026-83102.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 7.4, Oracle Forms)
- [CVE-2026-83101](https://cve.now/CVE-2026-83101.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 8.1, Oracle Forms)
- [CVE-2026-83100](https://cve.now/CVE-2026-83100.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.8, Oracle Forms)
- [CVE-2026-83099](https://cve.now/CVE-2026-83099.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 10.0, Oracle Forms)
- [CVE-2026-83098](https://cve.now/CVE-2026-83098.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.8, Oracle Forms)
- [CVE-2026-83097](https://cve.now/CVE-2026-83097.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 6.5, Oracle Forms)
- [CVE-2026-83096](https://cve.now/CVE-2026-83096.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 7.9, Oracle Forms)
- [CVE-2026-83095](https://cve.now/CVE-2026-83095.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.8, Oracle Forms)
- [CVE-2026-83094](https://cve.now/CVE-2026-83094.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 9.8, Oracle Forms)
- [CVE-2026-83093](https://cve.now/CVE-2026-83093.md): Vulnerability in the Oracle Forms product of Oracle Fusion Middleware (component: Forms Services, C/S, Charmode). (CVSS 8.6, Oracle Forms)
- [CVE-2026-83092](https://cve.now/CVE-2026-83092.md): Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.1, Oracle Field Service)
- [CVE-2026-83091](https://cve.now/CVE-2026-83091.md): Vulnerability in the Oracle Field Service product of Oracle E-Business Suite (component: Internal Operations). (CVSS 7.6, Oracle Field Service)
- [CVE-2026-83090](https://cve.now/CVE-2026-83090.md): Vulnerability in the Oracle Spares Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.8, Oracle Spares Management)
- [CVE-2026-83089](https://cve.now/CVE-2026-83089.md): Vulnerability in the Oracle Alert product of Oracle E-Business Suite (component: Internal Operations). (CVSS 8.1, Oracle Alert)
- [CVE-2026-83088](https://cve.now/CVE-2026-83088.md): Vulnerability in the RDBMS component of Oracle Database Server. (CVSS 7.7, Oracle Database Server)
- [CVE-2026-83087](https://cve.now/CVE-2026-83087.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 8.2, Oracle Siebel CRM Cloud Applications)
- [CVE-2026-83086](https://cve.now/CVE-2026-83086.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 8.8, Oracle Siebel CRM Cloud Applications)
- [CVE-2026-83085](https://cve.now/CVE-2026-83085.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 8.2, Oracle Siebel CRM Cloud Applications)
- [CVE-2026-83084](https://cve.now/CVE-2026-83084.md): Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). (CVSS 7.7, Oracle Marketing)
- [CVE-2026-83083](https://cve.now/CVE-2026-83083.md): Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). (CVSS 8.5, Oracle Marketing)
- [CVE-2026-83082](https://cve.now/CVE-2026-83082.md): Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience). (CVSS 7.2, Oracle Marketing)
- [CVE-2026-83081](https://cve.now/CVE-2026-83081.md): Vulnerability in the Oracle Banking Corporate Lending product of Oracle Financial Services Applications (component: Core). (CVSS 8.0, Oracle Banking Corporate Lending)
- [CVE-2026-83080](https://cve.now/CVE-2026-83080.md): Vulnerability in the Oracle Banking Branch product of Oracle Financial Services Applications (component: Reports). (CVSS 7.1, Oracle Banking Branch)
- [CVE-2026-83079](https://cve.now/CVE-2026-83079.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 7.9, Oracle Siebel CRM Cloud Applications)
- [CVE-2026-83078](https://cve.now/CVE-2026-83078.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 8.2, Oracle Siebel CRM Cloud Applications)
- [CVE-2026-83077](https://cve.now/CVE-2026-83077.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 6.4, Oracle Siebel CRM Cloud Applications)
- [CVE-2026-83076](https://cve.now/CVE-2026-83076.md): Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). (CVSS 6.8, Oracle HR Intelligence)
- [CVE-2026-83075](https://cve.now/CVE-2026-83075.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 7.5, Oracle Siebel CRM Cloud Applications)
- [CVE-2026-83074](https://cve.now/CVE-2026-83074.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 8.6, Oracle Siebel CRM Cloud Applications)
- [CVE-2026-83073](https://cve.now/CVE-2026-83073.md): Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). (CVSS 8.1, Oracle Siebel CRM Cloud Applications)
- [CVE-2026-83072](https://cve.now/CVE-2026-83072.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Search Bean \[Incl. (CVSS 8.1, Oracle Applications Framework)
- [CVE-2026-83071](https://cve.now/CVE-2026-83071.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Machine Learning). (CVSS 7.8, Oracle Business Intelligence Enterprise Edition)
- [CVE-2026-83070](https://cve.now/CVE-2026-83070.md): Vulnerability in the PeopleSoft Enterprise PRTL Interaction Hub product of Oracle PeopleSoft (component: Enterprise Portal). (CVSS 7.7, Oracle PeopleSoft Enterprise PRTL Interaction Hub)
- [CVE-2026-83069](https://cve.now/CVE-2026-83069.md): Vulnerability in the Oracle Fusion Middleware Control product of Oracle Fusion Middleware (component: Framework). (CVSS 8.8, Oracle Fusion Middleware Control)
- [CVE-2026-83068](https://cve.now/CVE-2026-83068.md): Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Core). (CVSS 7.7, Oracle Enterprise Manager for Oracle Database)
- [CVE-2026-83067](https://cve.now/CVE-2026-83067.md): Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Shared Components). (CVSS 8.1, Oracle JDeveloper)
- [CVE-2026-83066](https://cve.now/CVE-2026-83066.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.8, Oracle Internet Directory)
- [CVE-2026-83065](https://cve.now/CVE-2026-83065.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 7.5, Oracle WebCenter Portal)
- [CVE-2026-83064](https://cve.now/CVE-2026-83064.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 9.1, Oracle WebCenter Portal)
- [CVE-2026-83063](https://cve.now/CVE-2026-83063.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 7.2, Oracle Internet Directory)
- [CVE-2026-83062](https://cve.now/CVE-2026-83062.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.8, Oracle Internet Directory)
- [CVE-2026-83061](https://cve.now/CVE-2026-83061.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.8, Oracle Internet Directory)
- [CVE-2026-83060](https://cve.now/CVE-2026-83060.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.8, Oracle Internet Directory)
- [CVE-2026-83059](https://cve.now/CVE-2026-83059.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 10.0, Oracle Internet Directory)
- [CVE-2026-83058](https://cve.now/CVE-2026-83058.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.9, Oracle Internet Directory)
- [CVE-2026-83057](https://cve.now/CVE-2026-83057.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.9, Oracle Internet Directory)
- [CVE-2026-83056](https://cve.now/CVE-2026-83056.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.9, Oracle Internet Directory)
- [CVE-2026-83055](https://cve.now/CVE-2026-83055.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.9, Oracle Internet Directory)
- [CVE-2026-83054](https://cve.now/CVE-2026-83054.md): Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server). (CVSS 9.8, Oracle Internet Directory)
- [CVE-2026-83053](https://cve.now/CVE-2026-83053.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 8.8, Oracle WebCenter Portal)
- [CVE-2026-83052](https://cve.now/CVE-2026-83052.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 7.6, Oracle WebCenter Portal)
- [CVE-2026-83051](https://cve.now/CVE-2026-83051.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 7.5, Oracle WebCenter Portal)
- [CVE-2026-83050](https://cve.now/CVE-2026-83050.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 7.1, Oracle WebCenter Portal)
- [CVE-2026-83049](https://cve.now/CVE-2026-83049.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Security Framework). (CVSS 8.5, Oracle WebCenter Portal)
- [CVE-2026-83048](https://cve.now/CVE-2026-83048.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 7.7, Oracle WebCenter Portal)
- [CVE-2026-83047](https://cve.now/CVE-2026-83047.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 8.2, Oracle WebCenter Portal)
- [CVE-2026-83046](https://cve.now/CVE-2026-83046.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 7.1, Oracle WebCenter Portal)
- [CVE-2026-83045](https://cve.now/CVE-2026-83045.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). (CVSS 8.5, Oracle WebCenter Portal)
- [CVE-2026-83044](https://cve.now/CVE-2026-83044.md): Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). (CVSS 7.1, Oracle XML Gateway)
- [CVE-2026-83043](https://cve.now/CVE-2026-83043.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). (CVSS 9.6, Oracle WebCenter Portal)
- [CVE-2026-83042](https://cve.now/CVE-2026-83042.md): Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). (CVSS 9.8, Oracle Identity Manager)
- [CVE-2026-83041](https://cve.now/CVE-2026-83041.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). (CVSS 7.7, Oracle WebCenter Portal)
- [CVE-2026-83040](https://cve.now/CVE-2026-83040.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). (CVSS 9.6, Oracle WebCenter Portal)
- [CVE-2026-83039](https://cve.now/CVE-2026-83039.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). (CVSS 9.9, Oracle WebCenter Portal)
- [CVE-2026-83038](https://cve.now/CVE-2026-83038.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: TopLink Integration). (CVSS 9.9, Oracle WebLogic Server)
- [CVE-2026-83037](https://cve.now/CVE-2026-83037.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 9.8, Oracle WebCenter Sites)
- [CVE-2026-83036](https://cve.now/CVE-2026-83036.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 9.8, Oracle WebCenter Sites)
- [CVE-2026-83035](https://cve.now/CVE-2026-83035.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 9.8, Oracle WebCenter Sites)
- [CVE-2026-83034](https://cve.now/CVE-2026-83034.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 7.5, Oracle WebCenter Sites)
- [CVE-2026-83033](https://cve.now/CVE-2026-83033.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 8.8, Oracle WebCenter Sites)
- [CVE-2026-83032](https://cve.now/CVE-2026-83032.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 8.8, Oracle WebCenter Sites)
- [CVE-2026-83031](https://cve.now/CVE-2026-83031.md): Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). (CVSS 9.9, Oracle WebCenter Sites)
- [CVE-2026-83030](https://cve.now/CVE-2026-83030.md): Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). (CVSS 8.3, Oracle Managed File Transfer)
- [CVE-2026-83029](https://cve.now/CVE-2026-83029.md): Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server). (CVSS 9.6, Oracle Managed File Transfer)
- [CVE-2026-83028](https://cve.now/CVE-2026-83028.md): Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle Identity Manager Connector)
- [CVE-2026-83027](https://cve.now/CVE-2026-83027.md): Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). (CVSS 9.3, Oracle Identity Manager Connector)
- [CVE-2026-83026](https://cve.now/CVE-2026-83026.md): Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). (CVSS 8.3, Oracle Identity Manager Connector)
- [CVE-2026-83025](https://cve.now/CVE-2026-83025.md): Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). (CVSS 8.7, Oracle Identity Manager Connector)
- [CVE-2026-83024](https://cve.now/CVE-2026-83024.md): Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). (CVSS 7.8, Oracle Identity Manager Connector)
- [CVE-2026-83023](https://cve.now/CVE-2026-83023.md): Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). (CVSS 8.6, Oracle Identity Manager Connector)
- [CVE-2026-83022](https://cve.now/CVE-2026-83022.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 7.9, Oracle WebCenter Enterprise Capture)
- [CVE-2026-83021](https://cve.now/CVE-2026-83021.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). (CVSS 10.0, Oracle WebLogic Server)
- [CVE-2026-83020](https://cve.now/CVE-2026-83020.md): Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). (CVSS 10.0, Oracle Platform Security for Java)
- [CVE-2026-83019](https://cve.now/CVE-2026-83019.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). (CVSS 8.1, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2026-83018](https://cve.now/CVE-2026-83018.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). (CVSS 7.8, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2026-83017](https://cve.now/CVE-2026-83017.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). (CVSS 8.8, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2026-83016](https://cve.now/CVE-2026-83016.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). (CVSS 7.2, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2026-83015](https://cve.now/CVE-2026-83015.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Cube Manager). (CVSS 7.0, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2026-83014](https://cve.now/CVE-2026-83014.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Cube Manager). (CVSS 8.1, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2026-83013](https://cve.now/CVE-2026-83013.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 8.8, Oracle WebCenter Enterprise Capture)
- [CVE-2026-83012](https://cve.now/CVE-2026-83012.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 7.7, Oracle WebCenter Enterprise Capture)
- [CVE-2026-83011](https://cve.now/CVE-2026-83011.md): Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). (CVSS 8.1, Oracle Platform Security for Java)
- [CVE-2026-83010](https://cve.now/CVE-2026-83010.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 8.1, Oracle WebCenter Enterprise Capture)
- [CVE-2026-83009](https://cve.now/CVE-2026-83009.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 8.8, Oracle WebCenter Enterprise Capture)
- [CVE-2026-83008](https://cve.now/CVE-2026-83008.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 8.8, Oracle WebCenter Enterprise Capture)
- [CVE-2026-83007](https://cve.now/CVE-2026-83007.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 8.5, Oracle WebCenter Enterprise Capture)
- [CVE-2026-83006](https://cve.now/CVE-2026-83006.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 9.1, Oracle WebCenter Enterprise Capture)
- [CVE-2026-83005](https://cve.now/CVE-2026-83005.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 8.8, Oracle WebCenter Enterprise Capture)
- [CVE-2026-83004](https://cve.now/CVE-2026-83004.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 7.2, Oracle WebCenter Enterprise Capture)
- [CVE-2026-83003](https://cve.now/CVE-2026-83003.md): Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). (CVSS 8.5, Oracle WebCenter Enterprise Capture)
- [CVE-2026-83002](https://cve.now/CVE-2026-83002.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 8.5, Oracle Access Manager)
- [CVE-2026-83001](https://cve.now/CVE-2026-83001.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.1, Oracle Access Manager)
- [CVE-2026-83000](https://cve.now/CVE-2026-83000.md): Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). (CVSS 9.8, Oracle Service Delivery Platform)
- [CVE-2026-82999](https://cve.now/CVE-2026-82999.md): Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). (CVSS 9.9, Oracle Service Delivery Platform)
- [CVE-2026-82998](https://cve.now/CVE-2026-82998.md): Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). (CVSS 9.9, Oracle Service Delivery Platform)
- [CVE-2026-82997](https://cve.now/CVE-2026-82997.md): Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler). (CVSS 9.9, Oracle Service Delivery Platform)
- [CVE-2026-82996](https://cve.now/CVE-2026-82996.md): Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). (CVSS 7.8, Oracle Platform Security for Java)
- [CVE-2026-82995](https://cve.now/CVE-2026-82995.md): Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). (CVSS 9.8, Oracle Platform Security for Java)
- [CVE-2026-82994](https://cve.now/CVE-2026-82994.md): Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). (CVSS 9.8, Oracle Platform Security for Java)
- [CVE-2026-82993](https://cve.now/CVE-2026-82993.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). (CVSS 8.5, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2026-82992](https://cve.now/CVE-2026-82992.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Installation). (CVSS 7.8, Oracle Siebel CRM Deployment)
- [CVE-2026-73966](https://cve.now/CVE-2026-73966.md): Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). (CVSS 7.2, Oracle Siebel Apps - Marketing)
- [CVE-2026-73965](https://cve.now/CVE-2026-73965.md): Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway). (CVSS 6.8, Oracle Siebel CRM Deployment)
- [CVE-2026-73963](https://cve.now/CVE-2026-73963.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). (CVSS 9.8, Oracle WebCenter Portal)
- [CVE-2026-73962](https://cve.now/CVE-2026-73962.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.6, Oracle Access Manager)
- [CVE-2026-73961](https://cve.now/CVE-2026-73961.md): Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). (CVSS 9.8, Oracle JDeveloper)
- [CVE-2026-73960](https://cve.now/CVE-2026-73960.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Ren Server). (CVSS 7.5, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2026-73959](https://cve.now/CVE-2026-73959.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). (CVSS 8.8, Oracle WebCenter Portal)
- [CVE-2026-73958](https://cve.now/CVE-2026-73958.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 8.1, Oracle Access Manager)
- [CVE-2026-73957](https://cve.now/CVE-2026-73957.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). (CVSS 9.3, Oracle WebCenter Portal)
- [CVE-2026-73956](https://cve.now/CVE-2026-73956.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). (CVSS 9.8, Oracle WebCenter Portal)
- [CVE-2026-73955](https://cve.now/CVE-2026-73955.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Charting). (CVSS 7.3, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2026-73954](https://cve.now/CVE-2026-73954.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). (CVSS 8.1, Oracle PeopleSoft Enterprise PeopleTools)
- [CVE-2026-73953](https://cve.now/CVE-2026-73953.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). (CVSS 9.8, Oracle WebCenter Portal)
- [CVE-2026-73952](https://cve.now/CVE-2026-73952.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). (CVSS 9.1, Oracle WebCenter Portal)
- [CVE-2026-73951](https://cve.now/CVE-2026-73951.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). (CVSS 8.1, Oracle WebCenter Portal)
- [CVE-2026-73950](https://cve.now/CVE-2026-73950.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.8, Oracle Access Manager)
- [CVE-2026-73949](https://cve.now/CVE-2026-73949.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). (CVSS 8.8, Oracle WebCenter Portal)
- [CVE-2026-73948](https://cve.now/CVE-2026-73948.md): Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). (CVSS 9.9, Oracle WebCenter Portal)
- [CVE-2026-73947](https://cve.now/CVE-2026-73947.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.8, Oracle Access Manager)
- [CVE-2026-73946](https://cve.now/CVE-2026-73946.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.1, Oracle Access Manager)
- [CVE-2026-73945](https://cve.now/CVE-2026-73945.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.9, Oracle Access Manager)
- [CVE-2026-73944](https://cve.now/CVE-2026-73944.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.1, Oracle Access Manager)
- [CVE-2026-73943](https://cve.now/CVE-2026-73943.md): Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). (CVSS 7.6, Oracle Identity Manager)
- [CVE-2026-73942](https://cve.now/CVE-2026-73942.md): Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). (CVSS 8.8, Oracle Identity Manager)
- [CVE-2026-73941](https://cve.now/CVE-2026-73941.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 8.6, Oracle Access Manager)
- [CVE-2026-73940](https://cve.now/CVE-2026-73940.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.8, Oracle Access Manager)
- [CVE-2026-73926](https://cve.now/CVE-2026-73926.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 8.7, Oracle Access Manager)
- [CVE-2026-71163](https://cve.now/CVE-2026-71163.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 9.9, Oracle Access Manager)
- [CVE-2026-71133](https://cve.now/CVE-2026-71133.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 10.0, Oracle Access Manager)
- [CVE-2026-71047](https://cve.now/CVE-2026-71047.md): Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). (CVSS 8.8, Oracle Identity Manager)
- [CVE-2026-70915](https://cve.now/CVE-2026-70915.md): Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). (CVSS 8.8, Oracle Identity Manager)
- [CVE-2026-70913](https://cve.now/CVE-2026-70913.md): Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle Identity Manager)
- [CVE-2026-70757](https://cve.now/CVE-2026-70757.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle WebLogic Server)
- [CVE-2026-70756](https://cve.now/CVE-2026-70756.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle WebLogic Server)
- [CVE-2026-70755](https://cve.now/CVE-2026-70755.md): Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File download). (CVSS 6.5, Oracle Web Applications Desktop Integrator)
- [CVE-2026-70748](https://cve.now/CVE-2026-70748.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle WebLogic Server)
- [CVE-2026-62597](https://cve.now/CVE-2026-62597.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). (CVSS 6.5, Oracle Enterprise Manager Base Platform)
- [CVE-2026-87288](https://cve.now/CVE-2026-87288.md): Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). (CVSS 8.1, Oracle GraalVM)
- [CVE-2026-87287](https://cve.now/CVE-2026-87287.md): Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). (CVSS 8.1, Oracle GraalVM)
- [CVE-2026-87286](https://cve.now/CVE-2026-87286.md): Vulnerability in the Oracle GraalVM product of Oracle Java SE (component: Compiler). (CVSS 8.1, Oracle GraalVM)
- [CVE-2026-18425](https://cve.now/CVE-2026-18425.md): IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages (CVSS 2.1, Concrete CMS)
- [CVE-2026-18424](https://cve.now/CVE-2026-18424.md): Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports (CVSS 2.1, Concrete CMS)
- [CVE-2026-32599](https://cve.now/CVE-2026-32599.md): Netmaker has a boolean‑based SQL Injection (CVSS 5.3, gravitl netmaker · github.com/gravitl/netmaker)
- [CVE-2026-61544](https://cve.now/CVE-2026-61544.md): libp2p-quic: Remote panic via certificate expiry race during QUIC handshake (CVSS 8.2, rust-libp2p · libp2p-quic)
- [CVE-2026-88922](https://cve.now/CVE-2026-88922.md): Go-getter vulnerable to a privilege escalation issue in its archive decompression handling (CVSS 6.7, HashiCorp Shared library)
- [CVE-2026-92240](https://cve.now/CVE-2026-92240.md): Out-of-bounds read in IMAP response parser (CVSS 9.1, Mozilla Thunderbird)
- [CVE-2026-92239](https://cve.now/CVE-2026-92239.md): Buffer overrun in IMAP (CVSS 8.1, Mozilla Thunderbird)
- [CVE-2026-92238](https://cve.now/CVE-2026-92238.md): Ambiguous parsing of mail headers (CVSS 9.8, Mozilla Thunderbird)
- [CVE-2026-76820](https://cve.now/CVE-2026-76820.md): OpenCTI: Synchronizer SSRF: stream fetch has no URL validation (CVSS 7.7, OpenCTI-Platform opencti)
- [CVE-2026-76821](https://cve.now/CVE-2026-76821.md): OpenCTI: User-Controlled ReDoS in JSON Ingestion Mapper (CVSS 7.1, OpenCTI-Platform opencti)
- [CVE-2026-88975](https://cve.now/CVE-2026-88975.md): Http4s: Ember HTTP/2 buffers a frame's declared payload before checking SETTINGS\_MAX\_FRAME\_SIZE (CVSS 7.5, http4s · org.http4s:http4s-ember-core\_2.13 +2)
- [CVE-2026-73458](https://cve.now/CVE-2026-73458.md): On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause the BFD session(s) to go down. This may result in undesirable network changes because various rou (CVSS 8.2, Arista Networks EOS)
- [CVE-2026-18423](https://cve.now/CVE-2026-18423.md): Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs allowing an authenticated user with permission on one Express entity to delete or rename saved search pres (CVSS 2.1, Concrete CMS)
- [CVE-2026-69206](https://cve.now/CVE-2026-69206.md): Http4s: DigestAuth allows replay of captured requests (CVSS 5.9, http4s · org.http4s:http4s-ember-core\_2.12 +2)
- [CVE-2026-18422](https://cve.now/CVE-2026-18422.md): Concrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation (CVSS 2.1, Concrete CMS)
- [CVE-2026-69202](https://cve.now/CVE-2026-69202.md): Http4s Ember HTTP/2: unbounded inbound body buffering (CVSS 7.5, http4s · org.http4s:http4s-ember-core\_2.12 +2)
- [CVE-2026-76707](https://cve.now/CVE-2026-76707.md): Unauthenticated Information Disclosure in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 4.3, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76706](https://cve.now/CVE-2026-76706.md): Unauthenticated Information Disclosure in EdgeConnect SD-WAN Orchestrator API allows exposure of sensitive data (CVSS 5.3, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76705](https://cve.now/CVE-2026-76705.md): Authenticated Buffer Overflow Vulnerability in an API Endpoint Leads to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 5.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76704](https://cve.now/CVE-2026-76704.md): Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in EdgeConnect SD-WAN Orchestrator Web-Based Management Interface (CVSS 5.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76703](https://cve.now/CVE-2026-76703.md): Authenticated Buffer Overflow Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways Web-Based Management Interface Causes Denial-of-Service (CVSS 5.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76702](https://cve.now/CVE-2026-76702.md): Authenticated Local Denial-of-Service Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 5.8, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76701](https://cve.now/CVE-2026-76701.md): Unauthenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 5.9, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76700](https://cve.now/CVE-2026-76700.md): Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 5.9, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76699](https://cve.now/CVE-2026-76699.md): Unauthenticated Buffer Overflow Vulnerability leads to Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 6.4, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76698](https://cve.now/CVE-2026-76698.md): Authenticated Command Injection Vulnerability leads to Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 6.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76697](https://cve.now/CVE-2026-76697.md): Authenticated Information Disclosure in HPE Networking EdgeConnect Enterprise Web-Based Management Interface (CVSS 6.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76696](https://cve.now/CVE-2026-76696.md): Unauthenticated Denial-of-Service (DoS) Vulnerability leads to Service Disruption in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 6.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76695](https://cve.now/CVE-2026-76695.md): Unauthenticated Buffer Overflow Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 6.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76694](https://cve.now/CVE-2026-76694.md): Authenticated Privilege Escalation Vulnerability in the Command Line Interface of HPE Networking EdgeConnect SD-WAN Gateways (CVSS 6.6, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76693](https://cve.now/CVE-2026-76693.md): Unauthenticated Denial-of-Service Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 7.0, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76692](https://cve.now/CVE-2026-76692.md): Unauthenticated Adjacent Information Disclosure and Denial-of-Service Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 7.1, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76691](https://cve.now/CVE-2026-76691.md): Authenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateway API Endpoint (CVSS 7.2, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76690](https://cve.now/CVE-2026-76690.md): Authenticated Remote Code Execution Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 7.2, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76689](https://cve.now/CVE-2026-76689.md): Authenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 7.2, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76688](https://cve.now/CVE-2026-76688.md): Authentication Bypass Vulnerabilities in the Web-Based Management Interface of EdgeConnect SD-WAN Orchestrator (CVSS 7.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76687](https://cve.now/CVE-2026-76687.md): Authenticated Arbitrary File Write Leading to Remote Code Execution in EdgeConnect SD-WAN Orchestrator (CVSS 7.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76686](https://cve.now/CVE-2026-76686.md): Unauthenticated Denial-of-Service (DoS) Vulnerability leads to Service Disruption in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 7.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76685](https://cve.now/CVE-2026-76685.md): Unauthenticated Buffer Overflow Vulnerability leads to Remote Code Execution or Denial-of-Service in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 8.1, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76684](https://cve.now/CVE-2026-76684.md): Authentication Bypass Vulnerabilities in HPE Networking EdgeConnect SD-WAN Orchestrator API (CVSS 8.1, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76683](https://cve.now/CVE-2026-76683.md): Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 8.1, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76682](https://cve.now/CVE-2026-76682.md): Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 8.2, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76681](https://cve.now/CVE-2026-76681.md): Authenticated Information Disclosure Vulnerability in HPE Networking EdgeConnect SD-WAN Orchestrator API (CVSS 8.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76680](https://cve.now/CVE-2026-76680.md): Authenticated Server-Side Request Forgery Vulnerabilities Leading to Information Disclosure in EdgeConnect SD-WAN Orchestrator (CVSS 8.5, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76679](https://cve.now/CVE-2026-76679.md): Unauthenticated Denial-of-Service Vulnerabilities in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 8.6, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76678](https://cve.now/CVE-2026-76678.md): Authenticated Command Injection Vulnerability leads to Remote Code Execution in EdgeConnect SD-WAN Gateways (CVSS 8.8, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76677](https://cve.now/CVE-2026-76677.md): Authorization Bypass Leading to Privilege Escalation in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 8.8, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76676](https://cve.now/CVE-2026-76676.md): Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in EdgeConnect SD-WAN Gateways (CVSS 8.8, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76675](https://cve.now/CVE-2026-76675.md): Authenticated Command Injection Vulnerability Leads to Privilege Escalation in EdgeConnect SD-WAN Gateways (CVSS 9.1, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76674](https://cve.now/CVE-2026-76674.md): Unauthenticated Buffer Overflow Vulnerabilities lead to Remote Code Execution in HPE Networking EdgeConnect SD-WAN Gateways (CVSS 9.8, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76673](https://cve.now/CVE-2026-76673.md): Authentication Bypass Vulnerabilities in API of EdgeConnect SD-WAN Orchestrator (CVSS 9.8, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76672](https://cve.now/CVE-2026-76672.md): Authenticated Sensitive Information Disclosure in HPE Networking EdgeConnect SD-WAN Orchestrator (CVSS 9.9, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76670](https://cve.now/CVE-2026-76670.md): Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator (CVSS 9.9, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-76669](https://cve.now/CVE-2026-76669.md): Authorization Bypass Leading to Privilege Escalation in EdgeConnect SD-WAN Orchestrator (CVSS 9.9, Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways)
- [CVE-2026-69218](https://cve.now/CVE-2026-69218.md): Http4s Ember HTTP/2: unbounded continuation frame accumulation (CVSS 7.5, http4s · org.http4s:http4s-ember-core\_2.12 +2)
- [CVE-2026-69203](https://cve.now/CVE-2026-69203.md): Http4s Ember HTTP/2: does not enforce SETTINGS\_MAX\_CONCURRENT\_STREAMS (CVSS 7.5, http4s · org.http4s:http4s-ember-core\_2.12 +2)
- [CVE-2026-69217](https://cve.now/CVE-2026-69217.md): Http4s: Ember Server accepts duplicate Content-Length headers (CVSS 8.7, http4s)
- [CVE-2026-69210](https://cve.now/CVE-2026-69210.md): Http4s: WebSocket decoder accepts negative length, causing infinite decode loop (CVSS 7.5, http4s)
- [CVE-2026-69215](https://cve.now/CVE-2026-69215.md): Http4s: CookieJar middleware matches by substring, leaking cookies cross-origin (CVSS 6.8, http4s · org.http4s:http4s-client\_2.12 +2)
- [CVE-2026-69205](https://cve.now/CVE-2026-69205.md): Http4s: Ember Transfer-Encoding value parsing (TE.CL / TE.0 request smuggling) (CVSS 8.7, http4s · org.http4s:http4s-ember-core\_3 +2)
- [CVE-2026-13327](https://cve.now/CVE-2026-13327.md): Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positi (CVSS 8.3, Devolutions Server)
- [CVE-2026-84850](https://cve.now/CVE-2026-84850.md): Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 a (CVSS 4.8, Devolutions Server)
- [CVE-2026-18421](https://cve.now/CVE-2026-18421.md): Concrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not control (CVSS 2.1, Concrete CMS)
- [CVE-2026-69212](https://cve.now/CVE-2026-69212.md): Http4s: FollowRedirect middleware leaks credentials over https-\>http same-authority redirect (CVSS 5.9, http4s)
- [CVE-2026-90969](https://cve.now/CVE-2026-90969.md): Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking (CVSS 6.5, Devolutions Server)
- [CVE-2026-68529](https://cve.now/CVE-2026-68529.md): Concrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entries (CVSS 2.1, Concrete CMS)
- [CVE-2026-69213](https://cve.now/CVE-2026-69213.md): Http4s Ember HTTP/2: unbounded outbound frame queue (CVSS 7.5, http4s · org.http4s:http4s-ember-core\_2.12 +2)
- [CVE-2026-84048](https://cve.now/CVE-2026-84048.md): Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery \< 4.4.2 (CVSS 6.3, joomgalleryfriends.net JoomGallery extension for Joomla)
- [CVE-2026-90971](https://cve.now/CVE-2026-90971.md): Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged (CVSS 6.5, Devolutions Server)
- [CVE-2026-68530](https://cve.now/CVE-2026-68530.md): Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other Boards' Instances (CVSS 2.1, Concrete CMS)
- [CVE-2026-69214](https://cve.now/CVE-2026-69214.md): Http4s: CookieJar middleware accepts arbitrary Set-Cookie domain (CVSS 6.8, http4s · org.http4s:http4s-client\_2.12 +2)
- [CVE-2026-68531](https://cve.now/CVE-2026-68531.md): Concrete CMS below 9.5.3 is vulnerable to Authenticated Denial of Service via Unescaped SQL LIKE Wildcards in Keyword Search (CVSS 2.1, Concrete CMS)
- [CVE-2026-69201](https://cve.now/CVE-2026-69201.md): Http4s: ResourceService and Webjar Service path escape via percent-encoded separators (CVSS 5.9, http4s · org.http4s:http4s-server\_2.12 +2)
- [CVE-2026-69216](https://cve.now/CVE-2026-69216.md): Http4s: Ember chunk parser lenience (TE.TE request smuggling) (CVSS 5.4, http4s · org.http4s:http4s-ember-core\_2.12 +2)
- [CVE-2026-69211](https://cve.now/CVE-2026-69211.md): Http4s: Set-Cookie rendering does not escape attribute delimiters (CVSS 4.8, http4s)
- [CVE-2026-81924](https://cve.now/CVE-2026-81924.md): Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Theme Page Template Activation (CVSS 2.1, Concrete CMS)
- [CVE-2026-69209](https://cve.now/CVE-2026-69209.md): Http4s: WebSocket decoder accepts unbounded message sizes (CVSS 7.5, http4s)
- [CVE-2026-82190](https://cve.now/CVE-2026-82190.md): Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 (CVSS 6.3, j2commerce.com J2Store extension for Joomla)
- [CVE-2026-81923](https://cve.now/CVE-2026-81923.md): Concrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor (CVSS 2.1, Concrete CMS)
- [CVE-2026-78081](https://cve.now/CVE-2026-78081.md): Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 (CVSS 7.1, j2commerce.com J2Store extension for Joomla)
- [CVE-2026-81922](https://cve.now/CVE-2026-81922.md): "In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages " (CVSS 2.1, Concrete CMS)
- [CVE-2026-81568](https://cve.now/CVE-2026-81568.md): Joomla Extension - j2commerce.com - Arbitrary file read via \`task=download\` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 (CVSS 8.7, j2commerce.com J2Store extension for Joomla)
- [CVE-2026-82191](https://cve.now/CVE-2026-82191.md): Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 (CVSS 5.3, j2commerce.com J2Store extension for Joomla)
- [CVE-2026-69208](https://cve.now/CVE-2026-69208.md): Http4s: DigestAuth nonce map grows unbounded (CVSS 7.5, http4s · org.http4s:http4s-ember-server\_2.12 +2)
- [CVE-2026-81567](https://cve.now/CVE-2026-81567.md): Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 (CVSS 8.7, j2commerce.com J2Store extension for Joomla)
- [CVE-2026-81921](https://cve.now/CVE-2026-81921.md): In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status (CVSS 2.3, Concrete CMS)
- [CVE-2026-82189](https://cve.now/CVE-2026-82189.md): Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 (CVSS 8.7, j2commerce.com J2Store extension for Joomla)
- [CVE-2026-81920](https://cve.now/CVE-2026-81920.md): Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Dashboard SEO Excluded Words Reset Endpoint (CVSS 2.3, Concrete CMS)
- [CVE-2026-73467](https://cve.now/CVE-2026-73467.md): On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System Plus (TACACS+) servers (CVSS 6.3, Arista Networks EOS)
- [CVE-2026-68532](https://cve.now/CVE-2026-68532.md): Concrete CMS 9.0.0 to 9.5.2 is vunerable to CSRF in Concrete CMS Group Type Deletion Dashboard Action (CVSS 2.3, Concrete CMS)
- [CVE-2026-69204](https://cve.now/CVE-2026-69204.md): Http4s: Ember accepts Transfer-Encoding combined with Content-Length (CL.TE request smuggling) (CVSS 9.2, http4s · org.http4s:http4s-ember-core\_2.12 +2)
- [CVE-2026-73466](https://cve.now/CVE-2026-73466.md): On affected platforms running Arista EOS, under certain circumstances plaintext user passwords (CVSS 6.3, Arista Networks EOS)
- [CVE-2026-73465](https://cve.now/CVE-2026-73465.md): On affected platforms running Arista EOS, under certain circumstances plaintext private keys (CVSS 6.3, Arista Networks EOS)
- [CVE-2026-58773](https://cve.now/CVE-2026-58773.md): In link\_load\_gnss\_image of link\_device.c, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 6.7, Google Android)
- [CVE-2026-58767](https://cve.now/CVE-2026-58767.md): In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. (CVSS 6.7, Google Android)
- [CVE-2026-58766](https://cve.now/CVE-2026-58766.md): In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2026-58765](https://cve.now/CVE-2026-58765.md): In GPU, there is a possible permission bypass due to a logic error in the code. (CVSS 6.7, Google Android)
- [CVE-2026-58755](https://cve.now/CVE-2026-58755.md): In smmu\_install\_nested\_ste of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. (CVSS 6.7, Google Android)
- [CVE-2026-58751](https://cve.now/CVE-2026-58751.md): In multiple functions of arm-smmu-v3.c, there is a possible use-after-free due to a logic error in the code. (CVSS 6.7, Google Android)
- [CVE-2026-58747](https://cve.now/CVE-2026-58747.md): In smmu\_detach\_dev of arm-smmu-v3.c, there is a possible permission bypass due to a logic error in the code. (CVSS 6.7, Google Android)
- [CVE-2026-58744](https://cve.now/CVE-2026-58744.md): In multiple locations, there is a possible escalation of privilege due to improper input validation. (CVSS 7.8, Google Android)
- [CVE-2026-58739](https://cve.now/CVE-2026-58739.md): In platform\_msg\_handler\_init of default\_msg\_handlers.c, there is a possible confused deputy due to a confused deputy. (CVSS 6.7, Google Android)
- [CVE-2026-58734](https://cve.now/CVE-2026-58734.md): In google\_mba\_recv\_msg of google\_mba\_poll.c, there is a possible out-of-bounds write due to a race condition. (CVSS 7.0, Google Android)
- [CVE-2026-58731](https://cve.now/CVE-2026-58731.md): In multiple functions of physmem\_extmem\_linux.c, there is a possible out-of-bounds read due to uninitialized data. (CVSS 6.2, Google Android)
- [CVE-2026-58728](https://cve.now/CVE-2026-58728.md): In ARM64\_TLBI of mmu.h, there is a possible memory corruption due to a race condition. (CVSS 7.0, Google Android)
- [CVE-2026-58726](https://cve.now/CVE-2026-58726.md): In FsmReleaseKey of fsm.c, there is a possible permission bypass due to a missing permission check. (CVSS 6.7, Google Android)
- [CVE-2026-58724](https://cve.now/CVE-2026-58724.md): In multiple locations, there is a possible use-after-free due to a race condition. (CVSS 7.0, Google Android)
- [CVE-2026-58721](https://cve.now/CVE-2026-58721.md): In multiple locations, there is a possible information disclosure due to uninitialized memory use. (CVSS 4.4, Google Android)
- [CVE-2026-58718](https://cve.now/CVE-2026-58718.md): In smmu\_detach\_dev\_nested of arm-smmu-v3.c, there is a possible escalation of privilege due to improper input validation. (CVSS 6.7, Google Android)
- [CVE-2026-58716](https://cve.now/CVE-2026-58716.md): In multiple locations, there is a possible time-of-check to time-of-use due to a race condition. (CVSS 6.7, Google Android)
- [CVE-2026-58710](https://cve.now/CVE-2026-58710.md): In DecodeFilmGrainParams of film\_grain\_dec.cc, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 8.8, Google Android)
- [CVE-2026-58704](https://cve.now/CVE-2026-58704.md): In Cellular Modem, there is a possible permission bypass due to a logic error in the code. (CVSS 8.8, KEV, Google Android)
- [CVE-2026-58701](https://cve.now/CVE-2026-58701.md): In trusty\_dputc of generic-arm64-smcall.c, there is a possible out-of-bounds write due to a race condition. (CVSS 7.0, Google Android)
- [CVE-2026-58699](https://cve.now/CVE-2026-58699.md): In Vp9DecEndOfStream of vp9hwd\_output.cc, there is a possible out-of-bounds read due to an incorrect bounds check. (CVSS 8.4, Google Android)
- [CVE-2026-58698](https://cve.now/CVE-2026-58698.md): In ap\_pmic\_poll\_msg\_handler of ap\_pmic\_ipc.c, there is a possible permission bypass due to a confused deputy. (CVSS 6.7, Google Android)
- [CVE-2026-58695](https://cve.now/CVE-2026-58695.md): In gmc\_phy\_lp3\_exit\_restore\_registers of phy\_power.c, there is a possible escalation of privilege due to a missing bounds check. (CVSS 7.8, Google Android)
- [CVE-2026-58691](https://cve.now/CVE-2026-58691.md): In FsmReleaseKey of fsm.c, there is a possible permission bypass due to improper input validation. (CVSS 8.4, Google Android)
- [CVE-2026-58683](https://cve.now/CVE-2026-58683.md): In IP Multimedia Subsystem, there is a possible out-of-bounds write due to improper input validation. (CVSS 8.8, Google Android)
- [CVE-2026-58679](https://cve.now/CVE-2026-58679.md): In gf\_ta\_test\_set\_config of gf\_ta\_test.c, there is a possible heap buffer overflow due to a logic error in the code. (CVSS 8.4, Google Android)
- [CVE-2026-58678](https://cve.now/CVE-2026-58678.md): In Bootloader, there is a possible permission bypass due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2026-57042](https://cve.now/CVE-2026-57042.md): In multiple functions of DreamPickerReceiver.kt, there is a possible permission bypass due to a confused deputy. (CVSS 6.7, Google Android)
- [CVE-2026-57035](https://cve.now/CVE-2026-57035.md): In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 6.7, Google Android)
- [CVE-2026-57014](https://cve.now/CVE-2026-57014.md): In phNxpNciHal\_ext\_process\_nfc\_init\_rsp of phNxpNciHal\_ext.cc, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 7.8, Google Android)
- [CVE-2026-57012](https://cve.now/CVE-2026-57012.md): In the Setup Wizard, there is a possible remote package install due to a missing permission check. (CVSS 8.4, Google Android)
- [CVE-2026-57008](https://cve.now/CVE-2026-57008.md): In Modem, there is a possible information disclosure due to improper input validation. (CVSS 7.5, Google Android)
- [CVE-2026-57006](https://cve.now/CVE-2026-57006.md): In acfw\_ffa.c, there is a possible secret read due to a logic error in the code. (CVSS 4.4, Google Android)
- [CVE-2026-56997](https://cve.now/CVE-2026-56997.md): In Av1DecodeFrameTag of vp9hwd\_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 8.8, Google Android)
- [CVE-2026-56992](https://cve.now/CVE-2026-56992.md): In multiple files, there is a possible permission bypass due to a confused deputy. (CVSS 6.7, Google Android)
- [CVE-2026-56989](https://cve.now/CVE-2026-56989.md): In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 6.7, Google Android)
- [CVE-2026-56988](https://cve.now/CVE-2026-56988.md): In multiple functions of bluetooth\_cco.cc, there is a possible use-after-free due to a race condition. (CVSS 6.4, Google Android)
- [CVE-2026-56986](https://cve.now/CVE-2026-56986.md): In multiple files, there is a possible out-of-bounds read due to type confusion. (CVSS 8.4, Google Android)
- [CVE-2026-56985](https://cve.now/CVE-2026-56985.md): In multiple files, there is a possible way to obtain signatures due to type confusion. (CVSS 8.4, Google Android)
- [CVE-2026-56982](https://cve.now/CVE-2026-56982.md): In VPU, there is a possible permission bypass due to a missing permission check. (CVSS 7.8, Google Android)
- [CVE-2026-56979](https://cve.now/CVE-2026-56979.md): In multiple locations, there is a possible permission bypass due to a logic error in the code. (CVSS 6.7, Google Android)
- [CVE-2026-56978](https://cve.now/CVE-2026-56978.md): In get\_global\_config\_item\_addr of gc.c, there is a possible out-of-bounds read due to a missing bounds check. (CVSS 8.4, Google Android)
- [CVE-2026-56975](https://cve.now/CVE-2026-56975.md): In Cellular Modem, there is a possible denial of service due to improper input validation. (CVSS 6.5, Google Android)
- [CVE-2026-56974](https://cve.now/CVE-2026-56974.md): In Start of AudioRtpPayloadEncoderNode.cpp, there is a possible out-of-bounds write due to improper input validation. (CVSS 8.8, Google Android)
- [CVE-2026-56973](https://cve.now/CVE-2026-56973.md): In multiple locations, there is a possible escalation of privilege due to a logic error in the code. (CVSS 6.7, Google Android)
- [CVE-2026-56972](https://cve.now/CVE-2026-56972.md): In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. (CVSS 6.7, Google Android)
- [CVE-2026-56970](https://cve.now/CVE-2026-56970.md): In multiple locations, there is a possible permission bypass due to a missing permission check. (CVSS 8.4, Google Android)
- [CVE-2026-56967](https://cve.now/CVE-2026-56967.md): In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow. (CVSS 8.0, Google Android)
- [CVE-2026-56964](https://cve.now/CVE-2026-56964.md): In multiple locations, there is a possible use-after-free due to a race condition. (CVSS 6.4, Google Android)
- [CVE-2026-56960](https://cve.now/CVE-2026-56960.md): In multiple locations, there is a possible use-after-free due to a logic error in the code. (CVSS 9.8, Google Android)
- [CVE-2026-56958](https://cve.now/CVE-2026-56958.md): In gf\_algo\_get\_cached\_dump\_data of gf\_algo.c, there is a possible out-of-bounds read due to a missing bounds check. (CVSS 5.5, Google Android)
- [CVE-2026-56950](https://cve.now/CVE-2026-56950.md): In validate\_ns\_buf of mbu\_class.rs, there is a possible information disclosure due to improper input validation. (CVSS 4.4, Google Android)
- [CVE-2026-56945](https://cve.now/CVE-2026-56945.md): In VPU, there is a possible out-of-bounds write due to a confused deputy. (CVSS 7.8, Google Android)
- [CVE-2026-56942](https://cve.now/CVE-2026-56942.md): In ReadTileInfo of vp9hwd\_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 8.8, Google Android)
- [CVE-2026-56941](https://cve.now/CVE-2026-56941.md): In multiple functions of fpc\_tee\_hal.c, there is a possible use-after-free due to a logic error in the code. (CVSS 8.4, Google Android)
- [CVE-2026-56932](https://cve.now/CVE-2026-56932.md): In Trusted Execution Environment, there is a possible memory corruption due to improper input validation. (CVSS 6.7, Google Android)
- [CVE-2026-56923](https://cve.now/CVE-2026-56923.md): In handle\_unmap\_req of tipc\_virtio\_dev.c, there is a possible memory corruption due to a race condition. (CVSS 6.4, Google Android)
- [CVE-2026-56922](https://cve.now/CVE-2026-56922.md): In CPM, there is a possible permission bypass due to a confused deputy. (CVSS 6.7, Google Android)
- [CVE-2026-56920](https://cve.now/CVE-2026-56920.md): In s\_decode\_vui\_param of fw\_hevc\_dec\_header.c, there is a possible out-of-bounds write due to a logic error in the code. (CVSS 8.8, Google Android)
- [CVE-2026-56915](https://cve.now/CVE-2026-56915.md): In bigo\_worker\_thread of bigo.c, there is a possible escalation of privilege due to a race condition. (CVSS 6.4, Google Android)
- [CVE-2026-56914](https://cve.now/CVE-2026-56914.md): In multiple locations, there is a possible use-after-free due to improper locking. (CVSS 8.4, Google Android)
- [CVE-2026-56907](https://cve.now/CVE-2026-56907.md): In VPU, there is a possible shared memory overwrite due to improper input validation. (CVSS 6.7, Google Android)
- [CVE-2026-56892](https://cve.now/CVE-2026-56892.md): In ReadDataElement of common.c, there is a possible information disclosure due to an incorrect bounds check. (CVSS 6.2, Google Android)
- [CVE-2026-56889](https://cve.now/CVE-2026-56889.md): In multiple locations, there is a possible permission bypass due to an integer overflow. (CVSS 6.7, Google Android)
- [CVE-2026-56888](https://cve.now/CVE-2026-56888.md): In multiple locations, there is a possible permission bypass due to side channel information disclosure. (CVSS 6.2, Google Android)
- [CVE-2026-56882](https://cve.now/CVE-2026-56882.md): In Cellular Modem, there is a possible information disclosure due to a logic error in the code. (CVSS 8.8, Google Android)
- [CVE-2026-56881](https://cve.now/CVE-2026-56881.md): In enable\_segment of remap.c, there is a possible permission bypass due to a logic error in the code. (CVSS 8.4, Google Android)
- [CVE-2026-56879](https://cve.now/CVE-2026-56879.md): In gmc\_mb\_msg\_handler of gmc\_mba.c, there is a possible memory corruption due to a confused deputy. (CVSS 6.7, Google Android)
- [CVE-2026-55366](https://cve.now/CVE-2026-55366.md): In IP Multimedia Subsystem, there is a possible authentication bypass due to a logic error in the code. (CVSS 9.8, Google Android)
- [CVE-2026-55365](https://cve.now/CVE-2026-55365.md): In multiple functions of remap.c, there is a possible out-of-bounds write due to an incorrect bounds check. (CVSS 6.7, Google Android)
- [CVE-2026-55359](https://cve.now/CVE-2026-55359.md): In multiple locations, there is a possible permission bypass due to a logic error in the code. (CVSS 7.8, Google Android)
- [CVE-2026-55351](https://cve.now/CVE-2026-55351.md): In VPU, there is a possible out-of-bounds write due to an integer overflow. (CVSS 7.8, Google Android)
- [CVE-2026-55343](https://cve.now/CVE-2026-55343.md): In decodeAmr of ImsMediaAudioPlayer.cpp, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 8.0, Google Android)
- [CVE-2026-55332](https://cve.now/CVE-2026-55332.md): In multiple locations, there is a possible out-of-bounds write due to improper input validation. (CVSS 6.7, Google Android)
- [CVE-2026-55331](https://cve.now/CVE-2026-55331.md): In IP Multimedia Subsystem, there is a possible out-of-bounds write due to an incorrect bounds check. (CVSS 8.8, Google Android)
- [CVE-2026-55323](https://cve.now/CVE-2026-55323.md): In gf\_base\_update\_finger\_base of gf\_base.c, there is a possible out-of-bounds write due to a heap buffer overflow. (CVSS 7.8, Google Android)
- [CVE-2026-55318](https://cve.now/CVE-2026-55318.md): In multiple locations, there is a possible use-after-free due to a race condition. (CVSS 8.8, Google Android)
- [CVE-2026-55317](https://cve.now/CVE-2026-55317.md): In printf of printf.c, there is a possible out-of-bounds write due to improper input validation. (CVSS 6.7, Google Android)
- [CVE-2026-55306](https://cve.now/CVE-2026-55306.md): In Cellular Modem, there is a possible denial of service due to improper input validation. (CVSS 7.5, Google Android)
- [CVE-2026-55304](https://cve.now/CVE-2026-55304.md): In addr\_remap\_address\_map of remap.c, there is a possible escalation of privilege due to a logic error in the code. (CVSS 6.7, Google Android)
- [CVE-2026-55302](https://cve.now/CVE-2026-55302.md): In multiple locations, there is a possible permission bypass due to a logic error in the code. (CVSS 6.7, Google Android)
- [CVE-2026-55301](https://cve.now/CVE-2026-55301.md): In Wave6VpuDecFlush of wave6.c, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 8.4, Google Android)
- [CVE-2026-0200](https://cve.now/CVE-2026-0200.md): In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow. (CVSS 8.8, Google Android)
- [CVE-2026-0199](https://cve.now/CVE-2026-0199.md): In gf\_ta\_test\_set\_config of gf\_ta\_test.c, there is a possible out-of-bounds write due to improper input validation. (CVSS 7.8, Google Android)
- [CVE-2026-0197](https://cve.now/CVE-2026-0197.md): In VPU, there is a possible information dislclosure due to a logic error in the code. (CVSS 4.4, Google Android)
- [CVE-2026-0194](https://cve.now/CVE-2026-0194.md): In multiple locations, there is a possible permission bypass due to an integer overflow. (CVSS 8.4, Google Android)
- [CVE-2026-0192](https://cve.now/CVE-2026-0192.md): In Bootloader, there is a possible escalation of privilege due to a missing permission check. (CVSS 6.7, Google Android)
- [CVE-2026-0189](https://cve.now/CVE-2026-0189.md): In ac\_init\_policy of init.c, there is a possible permission bypass due to a logic error in the code. (CVSS 8.4, Google Android)
- [CVE-2026-0187](https://cve.now/CVE-2026-0187.md): In gsa\_sw\_pk\_hash\_compare of image-auth-srv.c, there is a possible escalation of privilege due to a logic error in the code. (CVSS 6.7, Google Android)
- [CVE-2026-0186](https://cve.now/CVE-2026-0186.md): In ac\_init\_one\_sswrp of init.c, there is a possible escalation of privilege due to a logic error in the code. (CVSS 6.7, Google Android)
- [CVE-2026-0183](https://cve.now/CVE-2026-0183.md): In CPM, there is a possible information disclosure due to a confused deputy. (CVSS 4.4, Google Android)
- [CVE-2026-0179](https://cve.now/CVE-2026-0179.md): In Bootloader, there is a possible permission bypass due to a missing permission check. (CVSS 6.7, Google Android)
- [CVE-2026-0177](https://cve.now/CVE-2026-0177.md): In do\_sss\_aes\_gcm\_256\_op of crypto-aes.c, there is a possible out-of-bounds read due to a missing bounds check. (CVSS 4.4, Google Android)
- [CVE-2026-0171](https://cve.now/CVE-2026-0171.md): In multiple locations, there is a possible out-of-bounds write due to a logic error in the code. (CVSS 8.8, Google Android)
- [CVE-2026-0170](https://cve.now/CVE-2026-0170.md): In Vp9DecodeFrameTag of vp9hwd\_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 8.8, Google Android)
- [CVE-2026-0159](https://cve.now/CVE-2026-0159.md): In Cellular Modem, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 8.8, Google Android)
- [CVE-2026-68533](https://cve.now/CVE-2026-68533.md): Missing Authorization in Concrete CMS versions below 9.5.3 Conversation File Upload Allows File Import Without the Add Message Attachments Permission (CVSS 2.3, Concrete CMS)
- [CVE-2026-68534](https://cve.now/CVE-2026-68534.md): Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors (CVSS 2.3, Concrete CMS)
- [CVE-2026-81919](https://cve.now/CVE-2026-81919.md): Concrete CMS below 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in Block Arrangement Endpoint (CVSS 2.3, Concrete CMS)
- [CVE-2026-19641](https://cve.now/CVE-2026-19641.md): On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legit (CVSS 5.3, Arista Networks EOS)
- [CVE-2026-73451](https://cve.now/CVE-2026-73451.md): On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can (CVSS 4.8, Arista Networks EOS)
- [CVE-2026-92176](https://cve.now/CVE-2026-92176.md): pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, pdfforge PDF Architect)
- [CVE-2026-92177](https://cve.now/CVE-2026-92177.md): pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, pdfforge PDF Architect)
- [CVE-2026-92178](https://cve.now/CVE-2026-92178.md): pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, pdfforge PDF Architect)
- [CVE-2026-92179](https://cve.now/CVE-2026-92179.md): pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, pdfforge PDF Architect)
- [CVE-2026-92180](https://cve.now/CVE-2026-92180.md): pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (CVSS 7.8, pdfforge PDF Architect)
- [CVE-2026-19781](https://cve.now/CVE-2026-19781.md): Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2026-19886](https://cve.now/CVE-2026-19886.md): OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, OriginLab Origin Viewer)
- [CVE-2026-19885](https://cve.now/CVE-2026-19885.md): OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, OriginLab Origin Viewer)
- [CVE-2026-19774](https://cve.now/CVE-2026-19774.md): BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.1, BlueZ)
- [CVE-2026-19773](https://cve.now/CVE-2026-19773.md): libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 9.8, libwebsockets)
- [CVE-2026-19504](https://cve.now/CVE-2026-19504.md): Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability (CVSS 4.0, Fabric.js)
- [CVE-2026-85234](https://cve.now/CVE-2026-85234.md): Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine (CVSS 7.5, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-81899](https://cve.now/CVE-2026-81899.md): Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members \> Groups dashboard (CVSS 7.3, Concrete CMS)
- [CVE-2026-57442](https://cve.now/CVE-2026-57442.md): MCPVault: PathFilter restricted directories (.git/.obsidian/node\_modules) only denied at vault root, not nested (CVSS 6.9, bitbonsai mcpvault · @bitbonsai/mcpvault)
- [CVE-2026-57441](https://cve.now/CVE-2026-57441.md): MCPVault: PathFilter restricted-directory deny-list bypass via case and trailing dot/space equivalence (CVSS 8.4, bitbonsai mcpvault · @bitbonsai/mcpvault)
- [CVE-2026-58483](https://cve.now/CVE-2026-58483.md): mcp-searxng: Unbounded Response Body Read Bypasses URL Size Limit in \`web\_url\_read\` (CVSS 7.5, ihor-sokoliuk mcp-searxng · mcp-searxng)
- [CVE-2026-40058](https://cve.now/CVE-2026-40058.md): Vulnerability Affecting Office Macro Removal in CrowdStrike Falcon Sensor for Windows (CVSS 8.8, CrowdStrike Falcon sensor for Windows · CrowdStrike Laroux…)
- [CVE-2026-81237](https://cve.now/CVE-2026-81237.md): Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Improper Authentication vulnerability. (CVSS 6.5, Dell Wyse Management Suite)
- [CVE-2026-58485](https://cve.now/CVE-2026-58485.md): mcp-searxng: DNS-resolved Private Hostname SSRF in \`web\_url\_read\` (CVSS 7.1, ihor-sokoliuk mcp-searxng · mcp-searxng)
- [CVE-2026-54688](https://cve.now/CVE-2026-54688.md): mcp-searxng: SSRF in web\_url\_read: the internal-address guard is disabled by default (MCP\_HTTP\_HARDEN off) (CVSS 6.5, ihor-sokoliuk mcp-searxng · mcp-searxng)
- [CVE-2026-81238](https://cve.now/CVE-2026-81238.md): Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Authentication for Critical Function vulnerability. (CVSS 7.5, Dell Wyse Management Suite)
- [CVE-2026-54689](https://cve.now/CVE-2026-54689.md): mcp-searxng hardened-mode SSRF bypasses permit internal URL access (CVSS 6.3, ihor-sokoliuk mcp-searxng · mcp-searxng)
- [CVE-2026-56830](https://cve.now/CVE-2026-56830.md): Shopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization (CVSS 6.5, shopperlabs shopper · shopper/framework)
- [CVE-2026-81235](https://cve.now/CVE-2026-81235.md): Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain a Missing Cryptographic Step vulnerability. (CVSS 8.0, Dell Wyse Management Suite)
- [CVE-2026-11728](https://cve.now/CVE-2026-11728.md): IBM MQ .NET client is vulnerable to remote code execution (CVSS 8.1, IBM MQ)
- [CVE-2026-56831](https://cve.now/CVE-2026-56831.md): Shopper: Negative discount values accepted and propagated through order calculation pipeline (CVSS 6.5, shopperlabs shopper · shopper/framework)
- [CVE-2026-56827](https://cve.now/CVE-2026-56827.md): Shopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers (CVSS 8.1, shopperlabs shopper · shopper/framework)
- [CVE-2026-81240](https://cve.now/CVE-2026-81240.md): Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. (CVSS 8.6, Dell Wyse Management Suite)
- [CVE-2026-56829](https://cve.now/CVE-2026-56829.md): Shopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component (CVSS 8.1, shopperlabs shopper · shopper/framework)
- [CVE-2026-18115](https://cve.now/CVE-2026-18115.md): In Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change\_password Enables Account Takeover. (CVSS 7.4, Concrete CMS)
- [CVE-2026-56825](https://cve.now/CVE-2026-56825.md): Shopper: Missing authorization on product removal actions in CollectionProducts component (CVSS 8.1, shopperlabs shopper · shopper/framework)
- [CVE-2026-58502](https://cve.now/CVE-2026-58502.md): githubtoplanguages: Command Injection via Issue Title in Discord Notification Workflow (CVSS 7.1, gouef githubtoplanguages)
- [CVE-2026-81239](https://cve.now/CVE-2026-81239.md): Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. (CVSS 8.6, Dell Wyse Management Suite)
- [CVE-2026-12910](https://cve.now/CVE-2026-12910.md): Missing Authentication for Critical Function in GitLab (CVSS 5.4, GitLab)
- [CVE-2026-13210](https://cve.now/CVE-2026-13210.md): Incorrect Authorization in GitLab (CVSS 7.7, GitLab)
- [CVE-2026-82837](https://cve.now/CVE-2026-82837.md): Insertion of Sensitive Information Into Sent Data in GitLab (CVSS 5.3, GitLab)
- [CVE-2026-81236](https://cve.now/CVE-2026-81236.md): Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. (CVSS 8.6, Dell Wyse Management Suite)
- [CVE-2026-55374](https://cve.now/CVE-2026-55374.md): canto-saas-api: Authenticated API requests can be redirected via unencoded path variables (CVSS 4.8, jleehr canto-saas-api · jleehr/canto-saas-api)
- [CVE-2026-18113](https://cve.now/CVE-2026-18113.md): Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Names (CVSS 7.5, Concrete CMS)
- [CVE-2026-11729](https://cve.now/CVE-2026-11729.md): IBM MQ Java messaging is vulnerable to remote code execution (CVSS 8.5, IBM MQ)
- [CVE-2026-55375](https://cve.now/CVE-2026-55375.md): canto-saas-api: OAuth credentials exposed in URL query string and exception messages (CVSS 5.3, jleehr canto-saas-api · jleehr/canto-saas-api)
- [CVE-2026-11864](https://cve.now/CVE-2026-11864.md): Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026. (CVSS 6.5, IBM Cloud Pak for Business Automation)
- [CVE-2026-81898](https://cve.now/CVE-2026-81898.md): Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views (CVSS 7.5, Concrete CMS)
- [CVE-2026-61668](https://cve.now/CVE-2026-61668.md): DIRAC: Pilot code downloaded over unverified HTTPS connection (CVSS 8.1, DIRACGrid DIRAC · dirac)
- [CVE-2026-11918](https://cve.now/CVE-2026-11918.md): IBM ContextForge MCP Gateway is affected by security filter bypass via nested payload structures (CVSS 5.4, IBM ContextForge MCP Gateway)
- [CVE-2026-11921](https://cve.now/CVE-2026-11921.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 9.1, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-61667](https://cve.now/CVE-2026-61667.md): DIRAC: RCE in FileCatalog DatasetManager via SQL injection + eval (CVSS 9.9, DIRACGrid DIRAC · dirac)
- [CVE-2026-53459](https://cve.now/CVE-2026-53459.md): Bambuddy's authentication fails open on database errors, allowing unauthenticated access to all endpoints (CVSS 9.3, maziggy bambuddy)
- [CVE-2026-45579](https://cve.now/CVE-2026-45579.md): DIRAC: RCE in RequestManager due to eval on untrusted input (CVSS 9.9, DIRACGrid DIRAC · dirac)
- [CVE-2026-11926](https://cve.now/CVE-2026-11926.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 7.5, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-11927](https://cve.now/CVE-2026-11927.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 6.5, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-53954](https://cve.now/CVE-2026-53954.md): Bugsink: DOS using large numbers of event tags (CVSS 4.3, bugsink)
- [CVE-2026-11928](https://cve.now/CVE-2026-11928.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 9.8, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-48785](https://cve.now/CVE-2026-48785.md): Apptainer: Incorrect path matching for 'limit container paths' directive (CVSS 4.8, apptainer · github.com/apptainer/apptainer)
- [CVE-2026-11929](https://cve.now/CVE-2026-11929.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 7.5, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-54549](https://cve.now/CVE-2026-54549.md): Meta Ads MCP: Server-Side Request Forgery (SSRF) in \`upload\_ad\_image\` via Unrestricted \`image\_url\` Fetch (CVSS 8.3, pipeboard-co meta-ads-mcp · meta-ads-mcp)
- [CVE-2026-54547](https://cve.now/CVE-2026-54547.md): Meta Ads MCP: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token (CVSS 7.4, pipeboard-co meta-ads-mcp · meta-ads-mcp)
- [CVE-2026-11934](https://cve.now/CVE-2026-11934.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 7.2, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-12101](https://cve.now/CVE-2026-12101.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 8.1, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-55225](https://cve.now/CVE-2026-55225.md): Strimzi: Cross-namespace privilege escalation via \`Kafka.spec.entityOperator\` (CVSS 8.0, strimzi-kafka-operator · io.strimzi:strimzi)
- [CVE-2026-12150](https://cve.now/CVE-2026-12150.md): IBM MQ queue manager is vulnerable to denial of service (CVSS 7.0, IBM MQ)
- [CVE-2026-12351](https://cve.now/CVE-2026-12351.md): IBM MQ is vulnerable to unauthenticated remote code execution via JNDI injection (CVSS 9.8, IBM MQ)
- [CVE-2026-55226](https://cve.now/CVE-2026-55226.md): Strimzi: Unrestricted access to all Secrets within namespace watched by the Topic operator (CVSS 5.4, strimzi-kafka-operator · io.strimzi:strimzi)
- [CVE-2026-54251](https://cve.now/CVE-2026-54251.md): netty-incubator-codec-ohttp: \[OHttpServerCodec\] Native Direct-Memory Leak on AEAD Decryption Failure Leads to Gateway Denial of Service (CVSS 8.7, netty-incubator-codec-ohttp · io.netty.incubator netty-i… +1)
- [CVE-2026-12354](https://cve.now/CVE-2026-12354.md): IBM MQ Resource Adapter IVT message-driven bean is vulnerable to remote code execution via JNDI injection (CVSS 7.5, IBM MQ)
- [CVE-2026-12355](https://cve.now/CVE-2026-12355.md): IBM MQ Resource Adapter IVT servlet is vulnerable to unauthenticated remote code execution (CVSS 8.1, IBM MQ)
- [CVE-2026-12358](https://cve.now/CVE-2026-12358.md): Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access (CVSS 7.5, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-54050](https://cve.now/CVE-2026-54050.md): Sakai: IDOR in Profile Image Deletion Allows Any Authenticated User to Delete Any User's Profile Image (CVSS 6.5, sakaiproject sakai · org.sakaiproject.profile2:profile2-… +1)
- [CVE-2026-44300](https://cve.now/CVE-2026-44300.md): OpenCost ServiceKey Endpoint Unauthorized Credential Overwrite/Injection (CVSS 8.8, opencost · github.com/opencost/opencost)
- [CVE-2026-12666](https://cve.now/CVE-2026-12666.md): IBM MQ Java messaging is vulnerable to XML external entity injection (CVSS 8.1, IBM MQ)
- [CVE-2026-12667](https://cve.now/CVE-2026-12667.md): IBM MQ .NET client is vulnerable to XML external entity injection (CVSS 7.1, IBM MQ)
- [CVE-2026-12728](https://cve.now/CVE-2026-12728.md): IBM MQ Java messaging is vulnerable to remote code execution (CVSS 8.8, IBM MQ)
- [CVE-2026-12742](https://cve.now/CVE-2026-12742.md): Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026 (CVSS 5.4, IBM Business Automation Workflow containers and traditional)
- [CVE-2026-88765](https://cve.now/CVE-2026-88765.md): Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab (CVSS 8.5, GitLab)
- [CVE-2026-12749](https://cve.now/CVE-2026-12749.md): Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026. (CVSS 6.4, IBM Cloud Pak for Business Automation)
- [CVE-2026-12750](https://cve.now/CVE-2026-12750.md): Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026. (CVSS 6.4, IBM Cloud Pak for Business Automation)
- [CVE-2026-12751](https://cve.now/CVE-2026-12751.md): Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026. (CVSS 5.4, IBM Cloud Pak for Business Automation)
- [CVE-2026-12752](https://cve.now/CVE-2026-12752.md): Multiple security vulnerabilities addressed with IBM Business Automation Workflow August 2026 (CVSS 7.1, IBM Business Automation Workflow containers and traditional)
- [CVE-2026-53941](https://cve.now/CVE-2026-53941.md): Inspektor Gadget Uprobe gadgets: unprivileged container's ld.so.cache causes high CPU utilization and container startup DoS (CVSS 6.9, inspektor-gadget · github.com/inspektor-gadget/inspektor-ga…)
- [CVE-2026-44778](https://cve.now/CVE-2026-44778.md): Inspektor Gadget: Unprivileged container can crash USDT note parser via crafted ELF (CVSS 2.9, inspektor-gadget · github.com/inspektor-gadget/inspektor-ga…)
- [CVE-2026-21588](https://cve.now/CVE-2026-21588.md): This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, (CVSS 7.1, Atlassian Confluence Data Center)
- [CVE-2026-21587](https://cve.now/CVE-2026-21587.md): This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. (CVSS 7.1, Atlassian Jira Service Management Data Center)
- [CVE-2026-21586](https://cve.now/CVE-2026-21586.md): This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, (CVSS 7.1, Atlassian Confluence Data Center)
- [CVE-2026-58201](https://cve.now/CVE-2026-58201.md): Lokka: Azure Resource Manager URL path validation issue (CVSS 8.7, merill lokka · @merill/lokka)
- [CVE-2026-53710](https://cve.now/CVE-2026-53710.md): MCP Context Forge: RestrictedPython sandbox bypass via getattr builtin in python\_sandbox\_server (CVSS 10.0, IBM mcp-context-forge · mcp-contextforge-gateway)
- [CVE-2026-81897](https://cve.now/CVE-2026-81897.md): Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save\_control (CVSS 7.7, Concrete CMS)
- [CVE-2026-55863](https://cve.now/CVE-2026-55863.md): motionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution (CVSS 5.3, motioneye-project motioneye · motioneye)
- [CVE-2026-46488](https://cve.now/CVE-2026-46488.md): motionEye: Authentication possible via password hash (CVSS 9.1, motioneye-project motioneye · motioneye)
- [CVE-2026-91855](https://cve.now/CVE-2026-91855.md): Open5GS PFCP Message handler.c denial of service (CVSS 6.9, Open5GS)
- [CVE-2026-81896](https://cve.now/CVE-2026-81896.md): Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label (CVSS 8.4, Concrete CMS)
- [CVE-2026-63443](https://cve.now/CVE-2026-63443.md): Coder: Workspace agent API insecure redirect handling allowed cross-agent file read and write (CVSS 8.3, coder · github.com/coder/coder +1)
- [CVE-2024-58385](https://cve.now/CVE-2024-58385.md): Yonyou U8 CRM SQL Injection via fillbacksettingedit.php (CVSS 9.3, Yonyou U8 CRM)
- [CVE-2023-54398](https://cve.now/CVE-2023-54398.md): Yonyou U8 Cloud Java Deserialization RCE via FileManageServlet (CVSS 9.3, Yonyou U8 Cloud)
- [CVE-2026-18111](https://cve.now/CVE-2026-18111.md): Concrete CMS below 9.5.4 allows privilege escalation because adding users and assigning groups do not require additional identity verification (CVSS 8.5, Concrete CMS)
- [CVE-2026-89026](https://cve.now/CVE-2026-89026.md): Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate (CVSS 9.3, Issabel Foundation Issabel Framework)
- [CVE-2026-81895](https://cve.now/CVE-2026-81895.md): Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via \`fsID\[\]\` in \`setMode=any\` (CVSS 8.5, Concrete CMS)
- [CVE-2026-54503](https://cve.now/CVE-2026-54503.md): plone.app.textfield: Stored XSS by spoofing mime type (CVSS 4.3, plone.app.textfield · plone-app-textfield)
- [CVE-2026-53658](https://cve.now/CVE-2026-53658.md): Fabric CA: LDAP Injection via Unescaped Username in GetUser Filter (CVSS 6.3, hyperledger fabric-ca · github.com/hyperledger/fabric-ca)
- [CVE-2026-59160](https://cve.now/CVE-2026-59160.md): Yeger: Unauthenticated Network-Exposed Turborepo Task Execution via /api/run (CVSS 8.8, DerYeger yeger · @yeger/turbo-graph)
- [CVE-2026-81894](https://cve.now/CVE-2026-81894.md): Concrete CMS 9.5.2 and below is vulnerable to Stored DOM-based Cross-site Scripting (XSS) in the Gallery block image Caption field (CVSS 8.5, Concrete CMS)
- [CVE-2026-55691](https://cve.now/CVE-2026-55691.md): EmbedVideo Extension : Stored XSS via unsanitized class passed to template (CVSS 8.6, StarCitizenWiki mediawiki-extensions-EmbedVideo · starcitiz…)
- [CVE-2026-55690](https://cve.now/CVE-2026-55690.md): EmbedVideo Extension: Stored XSS via unsanitized service name in exception text (CVSS 7.5, StarCitizenWiki mediawiki-extensions-EmbedVideo · starcitiz…)
- [CVE-2026-18110](https://cve.now/CVE-2026-18110.md): Concrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the complete backend user directory — internal ID, username (CVSS 8.7, Concrete CMS)
- [CVE-2026-55692](https://cve.now/CVE-2026-55692.md): EmbedVideo Extension: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled (CVSS 7.5, StarCitizenWiki mediawiki-extensions-EmbedVideo · starcitiz…)
- [CVE-2026-54561](https://cve.now/CVE-2026-54561.md): MCP Memory Keeper: Arbitrary local file read in mcp-memory-keeper context\_import via unvalidated filePath (CVSS 6.2, mkreyman mcp-memory-keeper · mcp-memory-keeper)
- [CVE-2026-55149](https://cve.now/CVE-2026-55149.md): Vouch Proxy: Unbounded Multipart Cookie Allocation DoS (CVSS 7.5, vouch-proxy · github.com/vouch/vouch-proxy)
- [CVE-2026-91854](https://cve.now/CVE-2026-91854.md): code-projects Record Management System reg.php cross site scripting (CVSS 5.3, code-projects Record Management System)
- [CVE-2026-58200](https://cve.now/CVE-2026-58200.md): @jhb.software/payload-cloudinary-plugin: Arbitrary Cloudinary API Parameter Signing (CVSS 7.1, jhb-software payload-plugins · @jhb.software/payload-cloudi…)
- [CVE-2026-79699](https://cve.now/CVE-2026-79699.md): Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory (CVSS 4.4, Red Hat Ansible Automation Platform · Red Hat Enterprise… +5)
- [CVE-2026-79705](https://cve.now/CVE-2026-79705.md): Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers (CVSS 4.5, Red Hat Hardened Images · Red Hat Ansible Automation Pla… +5)
- [CVE-2026-91853](https://cve.now/CVE-2026-91853.md): TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection (CVSS 5.3, TOTOLINK X5000R)
- [CVE-2026-89022](https://cve.now/CVE-2026-89022.md): BookStack \< 26.05.5 Authentication Bypass via Social Login Provider Confusion (CVSS 9.1, bookstackapp bookstack)
- [CVE-2026-19780](https://cve.now/CVE-2026-19780.md): Koha Eval Code Injection Remote Code Execution Vulnerability (CVSS 8.8, Koha)
- [CVE-2026-59965](https://cve.now/CVE-2026-59965.md): @jhb.software/payload-alt-text-plugin: Alt Text Endpoint Authorization Bypass via Payload Local API \`overrideAccess\` Omission (CVSS 7.1, jhb-software payload-plugins · @jhb.software payload-alt… +1)
- [CVE-2026-58196](https://cve.now/CVE-2026-58196.md): ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) (CVSS 4.7, stacklok toolhive · github.com/stacklok/toolhive)
- [CVE-2026-54450](https://cve.now/CVE-2026-54450.md): ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway (CVSS 2.9, stacklok toolhive · github.com/stacklok/toolhive)
- [CVE-2026-59157](https://cve.now/CVE-2026-59157.md): webhookd: Unrestricted HTTP Header to Shell Variable Injection (CVSS 6.5, ncarlier webhookd · github.com/ncarlier/webhookd)
- [CVE-2026-55887](https://cve.now/CVE-2026-55887.md): MCP Gateway: Argument injection via OCI image label YAML in Docker MCP Gateway (CVSS 8.7, docker mcp-gateway · github.com/docker/mcp-gateway)
- [CVE-2026-55770](https://cve.now/CVE-2026-55770.md): OpenBao: LDAPi ldaputil (wrong escape func) (CVSS 6.8, openbao · github.com/openbao/openbao)
- [CVE-2026-55776](https://cve.now/CVE-2026-55776.md): OpenBao: Transit secrets engine crashes on key creation with \`derived: true\` for asymmetric key types (CVSS 6.5, openbao · github.com/openbao/openbao)
- [CVE-2026-55774](https://cve.now/CVE-2026-55774.md): OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808 (CVSS 2.1, openbao · github.com/openbao/openbao)
- [CVE-2026-55775](https://cve.now/CVE-2026-55775.md): OpenBao's System Backend allows Unauthorized Management of the containing Namespace (CVSS 2.3, openbao · github.com/openbao/openbao)
- [CVE-2026-44163](https://cve.now/CVE-2026-44163.md): fluent-plugin-opentelemetry: Denial of Service (DoS) via Large Payloads and Decompression Bombs in \`in\_opentelemetry\` (CVSS 5.3, fluent-plugins-nursery fluent-plugin-opentelemetry · fluent…)
- [CVE-2026-77866](https://cve.now/CVE-2026-77866.md): SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts (CVSS 9.0, Slab safeurl)
- [CVE-2026-55591](https://cve.now/CVE-2026-55591.md): Signal K Server: Server-Side Request Forgery via Remote Connection Endpoints (CVSS 5.8, signalk-server)
- [CVE-2026-77972](https://cve.now/CVE-2026-77972.md): safeurl validated address is not bound to the request, allowing DNS rebinding (CVSS 9.0, Slab safeurl)
- [CVE-2026-55864](https://cve.now/CVE-2026-55864.md): GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool (CVSS 7.8, core-geonetwork · org.geonetwork-opensource:gn-web-app)
- [CVE-2026-55630](https://cve.now/CVE-2026-55630.md): Kiwi TCMS: Stored XSS via javascript: URI in extra\_link field (TestPlan & TestCase) (CVSS 0.0, kiwitcms Kiwi · kiwitcms)
- [CVE-2026-54724](https://cve.now/CVE-2026-54724.md): Kiwi TCMS: Open Redirect via unvalidated next parameter in account confirmation endpoint (CVSS 6.1, kiwitcms Kiwi · kiwitcms)
- [CVE-2026-91849](https://cve.now/CVE-2026-91849.md): WuzhiCMS Avatar Upload index.php setAvatar unrestricted upload (CVSS 5.3, WuzhiCMS)
- [CVE-2026-55211](https://cve.now/CVE-2026-55211.md): surfio IRAP header size fields cause out-of-bounds reads (CVSS 9.8, equinor surfio · surfio)
- [CVE-2026-55636](https://cve.now/CVE-2026-55636.md): Capsule: Incomplete fix of CVE-2026-30963: singular/plural typo leaves namespaces/finalize unprotected (CVSS 5.7, projectcapsule capsule · github.com/projectcapsule/capsule)
- [CVE-2026-44282](https://cve.now/CVE-2026-44282.md): Election question titles allow stored script execution (CVSS 4.8, decidim · decidim-elections)
- [CVE-2026-89307](https://cve.now/CVE-2026-89307.md): HTML injection allows open redirection in WordPress theme design-scuole-wordpress-theme (CVSS 5.1, Developers Italia design-scuole-wordpress-theme)
- [CVE-2026-19407](https://cve.now/CVE-2026-19407.md): GCS Bucket Squatting leading to RCE in Gemini Enterprise Agent Platform Python SDK (CVSS 7.7, Google Cloud Gemini Enterprise Agent Platform SDK for Python)
- [CVE-2026-87793](https://cve.now/CVE-2026-87793.md): Reflected XSS in WordPress theme design-scuole-wordpress-theme (CVSS 5.1, Developers Italia design-scuole-wordpress-theme)
- [CVE-2026-87792](https://cve.now/CVE-2026-87792.md): Multiple authorization bypass in WordPress theme design-scuole-wordpress-theme (CVSS 8.7, Developers Italia design-scuole-wordpress-theme)
- [CVE-2026-91992](https://cve.now/CVE-2026-91992.md): Tornado before 6.5.7 Credential Leak via Handle Reuse (CVSS 8.2, tornadoweb tornado · tornado)
- [CVE-2026-91991](https://cve.now/CVE-2026-91991.md): Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs (CVSS 6.3, tornadoweb tornado · tornado)
- [CVE-2026-65831](https://cve.now/CVE-2026-65831.md): ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read (CVSS 7.7, ArcadeData arcadedb · com.arcadedb arcadedb-server +1)
- [CVE-2026-91990](https://cve.now/CVE-2026-91990.md): Tornado before 6.5.8 Memory Amplification DoS via multipart (CVSS 8.7, tornadoweb tornado · tornado)
- [CVE-2026-91989](https://cve.now/CVE-2026-91989.md): atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py (CVSS 8.7, dep0we atomic-agents-stack · atomic-agents-stack)
- [CVE-2026-91988](https://cve.now/CVE-2026-91988.md): atomic-agents-stack before 1.1.0 Remote Code Execution via HTTP MCP (CVSS 9.2, dep0we atomic-agents-stack · atomic-agents-stack)
- [CVE-2026-91987](https://cve.now/CVE-2026-91987.md): atomic-agents-stack before 1.1.0 Cost Guardrail Bypass via Unknown Model (CVSS 7.1, dep0we atomic-agents-stack · atomic-agents-stack)
- [CVE-2026-91986](https://cve.now/CVE-2026-91986.md): gitoxide gix-transport before 0.59.2 CR/LF/NUL Injection (CVSS 5.3, GitoxideLabs gitoxide)
- [CVE-2026-91985](https://cve.now/CVE-2026-91985.md): Vikunja before 2.6.0 Privilege Escalation via Link Share Hash (CVSS 8.7, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-91984](https://cve.now/CVE-2026-91984.md): Vikunja before 2.6.0 Broken Object-Level Authorization via task-position (CVSS 5.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-91983](https://cve.now/CVE-2026-91983.md): Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter (CVSS 5.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-91982](https://cve.now/CVE-2026-91982.md): Vikunja before 2.6.0 TOTP Secret Disclosure via API (CVSS 4.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-91981](https://cve.now/CVE-2026-91981.md): Vikunja before 2.6.0 User Enumeration via v2 API (CVSS 4.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-91980](https://cve.now/CVE-2026-91980.md): vikunja before 2.6.0 Team Enumeration via Project Share (CVSS 4.3, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-91979](https://cve.now/CVE-2026-91979.md): Vikunja before 2.6.0 Denial of Service via Decompression Bomb (CVSS 6.5, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-91973](https://cve.now/CVE-2026-91973.md): Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth (CVSS 8.7, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-91972](https://cve.now/CVE-2026-91972.md): Vikunja before 2.6.0 Authentication Bypass via Unthrottled API (CVSS 8.7, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-91971](https://cve.now/CVE-2026-91971.md): Vikunja before 2.6.0 Denial of Service via Avatar Upload (CVSS 7.1, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-91970](https://cve.now/CVE-2026-91970.md): Vikunja before 2.6.0 Resource Exhaustion via Planka Migration (CVSS 6.5, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-91969](https://cve.now/CVE-2026-91969.md): vikunja before 2.6.0 Resource Exhaustion via CSV Migration (CVSS 6.5, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-91968](https://cve.now/CVE-2026-91968.md): vikunja before 2.6.0 Denial of Service via unbounded filter recursion (CVSS 6.5, go-vikunja vikunja · code.vikunja.io/api)
- [CVE-2026-91967](https://cve.now/CVE-2026-91967.md): AVideo through 29.0 Blind SSRF via getHeaderContentTypeFromURL (CVSS 5.3, WWBN AVideo)
- [CVE-2026-91966](https://cve.now/CVE-2026-91966.md): AVideo through 29.0 Unauthenticated SSRF via Host Header (CVSS 6.9, WWBN AVideo)
- [CVE-2026-91965](https://cve.now/CVE-2026-91965.md): WWBN AVideo through 29.0 Broken Access Control via Live Endpoints (CVSS 8.7, WWBN AVideo)
- [CVE-2026-91964](https://cve.now/CVE-2026-91964.md): FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken (CVSS 8.7, FreeRDP)
- [CVE-2026-91963](https://cve.now/CVE-2026-91963.md): FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc (CVSS 7.1, FreeRDP)
- [CVE-2026-91962](https://cve.now/CVE-2026-91962.md): FreeRDP before 3.31.0 Integer Overflow via audin Apple backends (CVSS 5.3, FreeRDP)
- [CVE-2026-91961](https://cve.now/CVE-2026-91961.md): FreeRDP before 3.31.0 Denial of Service via URBDRC (CVSS 7.1, FreeRDP)
- [CVE-2026-91960](https://cve.now/CVE-2026-91960.md): FreeRDP before 3.31.0 Integer Overflow Double Free (CVSS 6.5, FreeRDP)
- [CVE-2026-91959](https://cve.now/CVE-2026-91959.md): FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway (CVSS 6.5, FreeRDP)
- [CVE-2026-91958](https://cve.now/CVE-2026-91958.md): FreeRDP 3.11.0 through 3.30.0 Heap Buffer Overflow via Monitor Index (CVSS 6.9, FreeRDP)
- [CVE-2026-91957](https://cve.now/CVE-2026-91957.md): FreeRDP before 3.31.0 Use-After-Free via smartcard worker (CVSS 2.3, FreeRDP)
- [CVE-2026-91956](https://cve.now/CVE-2026-91956.md): FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC (CVSS 7.1, FreeRDP)
- [CVE-2026-91955](https://cve.now/CVE-2026-91955.md): FreeRDP before 3.31.0 Denial of Service via Desktop Dimensions (CVSS 8.2, FreeRDP)
- [CVE-2026-91954](https://cve.now/CVE-2026-91954.md): FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec (CVSS 7.1, FreeRDP)
- [CVE-2026-91953](https://cve.now/CVE-2026-91953.md): FreeRDP before 3.31.0 Heap Buffer Overflow via LB\_LOAD\_BALANCE\_INFO (CVSS 7.1, FreeRDP)
- [CVE-2026-91952](https://cve.now/CVE-2026-91952.md): FreeRDP before 3.31.0 Denial of Service via pool\_decode\_rect (CVSS 7.1, FreeRDP)
- [CVE-2026-91951](https://cve.now/CVE-2026-91951.md): FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrc (CVSS 7.1, FreeRDP)
- [CVE-2026-91950](https://cve.now/CVE-2026-91950.md): FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparound (CVSS 7.1, FreeRDP)
- [CVE-2026-91949](https://cve.now/CVE-2026-91949.md): FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass (CVSS 9.2, FreeRDP)
- [CVE-2026-91948](https://cve.now/CVE-2026-91948.md): FreeRDP before 3.31.0 Out-of-bounds Write via SHOW\_PROTOCOL (CVSS 7.7, FreeRDP)
- [CVE-2026-91947](https://cve.now/CVE-2026-91947.md): FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVC (CVSS 7.7, FreeRDP)
- [CVE-2026-91946](https://cve.now/CVE-2026-91946.md): FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics (CVSS 7.1, FreeRDP)
- [CVE-2026-91945](https://cve.now/CVE-2026-91945.md): FreeRDP before 3.31.0 Out-of-bounds Read via Smartcard ATR (CVSS 7.1, FreeRDP)
- [CVE-2026-91944](https://cve.now/CVE-2026-91944.md): crawl4ai before 0.9.3 DOM-based XSS via Playground UI (CVSS 5.1, unclecode crawl4ai)
- [CVE-2026-91943](https://cve.now/CVE-2026-91943.md): Crawl4AI before 0.9.3 SSRF via PDFContentScrapingStrategy (CVSS 8.3, unclecode crawl4ai)
- [CVE-2026-91942](https://cve.now/CVE-2026-91942.md): crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML (CVSS 5.1, unclecode crawl4ai)
- [CVE-2026-91941](https://cve.now/CVE-2026-91941.md): Crawl4AI before 0.9.3 Denial of Service via PDFContentScrapingStrategy (CVSS 8.7, unclecode crawl4ai)
- [CVE-2026-91940](https://cve.now/CVE-2026-91940.md): crawl4ai before 0.9.3 Arbitrary File Write via PDFContentScrapingStrategy (CVSS 8.7, unclecode crawl4ai)
- [CVE-2026-91938](https://cve.now/CVE-2026-91938.md): Flowise before 3.1.4 Server-Side Request Forgery via document loaders (CVSS 7.1, FlowiseAI Flowise)
- [CVE-2026-91937](https://cve.now/CVE-2026-91937.md): Flowise before 3.1.4 NoSQL Injection via sessionId (CVSS 7.5, FlowiseAI Flowise)
- [CVE-2026-91936](https://cve.now/CVE-2026-91936.md): Flowise before 3.1.4 Script Injection via Docker Workflows (CVSS 6.8, FlowiseAI Flowise)
- [CVE-2026-91935](https://cve.now/CVE-2026-91935.md): Flowise before 3.1.4 SSRF and API Key Exfiltration via Chat Model Nodes (CVSS 8.3, FlowiseAI Flowise)
- [CVE-2026-91934](https://cve.now/CVE-2026-91934.md): Flowise before 3.1.4 Remote Code Execution via SQL Database Chain (CVSS 8.8, FlowiseAI Flowise)
- [CVE-2026-91933](https://cve.now/CVE-2026-91933.md): Flowise before 3.1.4 Authorization Bypass via openai-realtime (CVSS 7.1, FlowiseAI Flowise)
- [CVE-2026-91932](https://cve.now/CVE-2026-91932.md): Flowise before 3.1.4 Remote Code Execution via cwd Parameter (CVSS 8.5, FlowiseAI Flowise)
- [CVE-2026-91931](https://cve.now/CVE-2026-91931.md): Flowise before 3.1.4 Remote Code Execution via Custom MCP npx (CVSS 8.5, FlowiseAI Flowise)
- [CVE-2026-91930](https://cve.now/CVE-2026-91930.md): Flowise before 3.1.4 Cross-Tenant Organization Admin Takeover (CVSS 7.5, FlowiseAI Flowise)
- [CVE-2026-91929](https://cve.now/CVE-2026-91929.md): Flowise before 3.1.4 Cross-Tenant Authorization Bypass (CVSS 7.1, FlowiseAI Flowise)
- [CVE-2024-58384](https://cve.now/CVE-2024-58384.md): Tornado before 6.4.1 CRLF Injection via CurlAsyncHTTPClient (CVSS 6.3, tornadoweb tornado · tornado)
- [CVE-2024-14029](https://cve.now/CVE-2024-14029.md): Tornado before 6.4.1 HTTP Request Smuggling via Transfer-Encoding (CVSS 9.0, tornadoweb tornado · tornado)
- [CVE-2023-54397](https://cve.now/CVE-2023-54397.md): Tornado before 6.3.3 HTTP Request Smuggling via Content-Length (CVSS 9.0, tornadoweb tornado · tornado)
- [CVE-2026-54077](https://cve.now/CVE-2026-54077.md): ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users (CVSS 7.1, ArcadeData arcadedb · com.arcadedb arcadedb-engine +1)
- [CVE-2026-54076](https://cve.now/CVE-2026-54076.md): ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221) (CVSS 8.1, ArcadeData arcadedb · com.arcadedb arcadedb-engine +1)
- [CVE-2026-91848](https://cve.now/CVE-2026-91848.md): WuzhiCMS index.php getDataOfJson sql injection (CVSS 6.9, WuzhiCMS)
- [CVE-2026-55828](https://cve.now/CVE-2026-55828.md): qbee transport: Symlink-chain path traversal in tar extraction (one level outside destination) (CVSS 6.0, qbee-io transport · go.qbee.io/transport)
- [CVE-2026-59973](https://cve.now/CVE-2026-59973.md): mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi (CVSS 8.5, agentfront frontmcp · agentfront mcp-from-openapi +4)
- [CVE-2026-87791](https://cve.now/CVE-2026-87791.md): Path traversal vulnerability in WordPress theme design-scuole-wordpress-theme (CVSS 8.7, Developers Italia design-scuole-wordpress-theme)
- [CVE-2026-85013](https://cve.now/CVE-2026-85013.md): Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters (CVSS 7.3, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-47215](https://cve.now/CVE-2026-47215.md): Singularity: Incorrect path matching for 'limit container paths' directive (CVSS 4.8, sylabs singularity · sylabs SingularityPRO +2)
- [CVE-2026-55701](https://cve.now/CVE-2026-55701.md): OpenTelemetry githubreceiver silently ignores configured required\_headers authentication (CVSS 6.9, open-telemetry opentelemetry-collector-contrib · github.com…)
- [CVE-2026-50024](https://cve.now/CVE-2026-50024.md): GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via a malicious .git server (CVSS 5.3, WangYihang GitHacker · githacker)
- [CVE-2026-91842](https://cve.now/CVE-2026-91842.md): OpenBankProject OBP-API Kryo Redis.scala KryoInjection.invert deserialization (CVSS 2.1, OpenBankProject OBP-API)
- [CVE-2026-55178](https://cve.now/CVE-2026-55178.md): GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data (CVSS 7.5, geolens-io geolens · @geolens/sdk +2)
- [CVE-2026-61549](https://cve.now/CVE-2026-61549.md): Woodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend (CVSS 9.0, woodpecker-ci woodpecker · github.com/woodpecker-ci/wood… +3)
- [CVE-2026-50166](https://cve.now/CVE-2026-50166.md): Kuma: kumactl connects to control plane without verifying TLS certificate when no CA is configured (CVSS 5.5, kumahq kuma · github.com/kumahq/kuma +1)
- [CVE-2026-63696](https://cve.now/CVE-2026-63696.md): Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Download of Code Without Integrity Check vulnerability. (CVSS 9.1, Dell SmartFabric OS10 Software)
- [CVE-2026-52724](https://cve.now/CVE-2026-52724.md): kuma-dp connects to control plane without verifying TLS certificate when no CA is configured (CVSS 5.8, kumahq kuma · github.com/kumahq/kuma/v2 +1)
- [CVE-2026-63695](https://cve.now/CVE-2026-63695.md): Dell SmartFabric OS10 Software, versions prior to 10.6.1.3, contains a Session Fixation vulnerability. (CVSS 9.8, Dell SmartFabric OS10 Software)
- [CVE-2026-55158](https://cve.now/CVE-2026-55158.md): Conflibot: Command injection via crafted pull request branch names under pull\_request\_target (CVSS 9.1, wktk conflibot)
- [CVE-2026-55617](https://cve.now/CVE-2026-55617.md): Hydro: Insufficient session expiration when recreating sessions (CVSS 6.9, hydro-dev Hydro · hydrooj)
- [CVE-2026-91836](https://cve.now/CVE-2026-91836.md): OpenClaw ClawScan Static Scanner static\_scanner.go incomplete comparison with missing factors (CVSS 2.4, OpenClaw ClawScan)
- [CVE-2026-47780](https://cve.now/CVE-2026-47780.md): free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence (CVSS 6.9, free5gc · github.com/free5gc/udr)
- [CVE-2026-48987](https://cve.now/CVE-2026-48987.md): pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager (CVSS 6.5, pyload · pyload-ng)
- [CVE-2026-48737](https://cve.now/CVE-2026-48737.md): pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs (CVSS 4.9, pyload · pyload-ng)
- [CVE-2026-53966](https://cve.now/CVE-2026-53966.md): XWiki Platform: Privilege escalation from edit to script right through Live Data editing (CVSS 7.1, xwiki-platform · org.xwiki.platform:xwiki-platform-livedata…)
- [CVE-2026-55650](https://cve.now/CVE-2026-55650.md): Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure (CVSS 4.4, outerbase studio · @outerbase/studio)
- [CVE-2026-53957](https://cve.now/CVE-2026-53957.md): Contentful MCP Server: export\_space/import\_space tools pass LLM-controlled \`host\`/\`proxy\` args to CMA client, redirecting server PAT to attacker-controlled endpoint (CVSS 7.7, contentful-mcp-server · @contentful mcp-server +3)
- [CVE-2026-54254](https://cve.now/CVE-2026-54254.md): Cyberdrop-DL: Pixeldrain API key shared with unverified thirdparty sites (CVSS 5.9, cyberdrop-dl · cyberdrop-dl-patched)
- [CVE-2026-49446](https://cve.now/CVE-2026-49446.md): Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server (CVSS 6.1, azukaar Cosmos-Server · github.com/azukaar/cosmos-server)
- [CVE-2026-54167](https://cve.now/CVE-2026-54167.md): Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header (CVSS 8.2, tektoncd pipelines-as-code · github.com/openshift-pipelines…)
- [CVE-2026-54168](https://cve.now/CVE-2026-54168.md): Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution (CVSS 6.5, tektoncd pipelines-as-code · github.com/openshift-pipelines…)
- [CVE-2026-90439](https://cve.now/CVE-2026-90439.md): NGINX ngx\_http\_v3\_module vulnerability (CVSS 6.5, F5 NGINX Plus · F5 NGINX Open Source)
- [CVE-2026-39919](https://cve.now/CVE-2026-39919.md): Ghostscript \< 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter (CVSS 9.3, Artifex Software Ghostscript)
- [CVE-2026-57586](https://cve.now/CVE-2026-57586.md): CodeRAG: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution (CVSS 8.6, naranor agent-coderag · agent-coderag)
- [CVE-2026-91835](https://cve.now/CVE-2026-91835.md): OpenClaw ClawScan File Classifier static\_scanner.go IsBinaryFile interpretation conflict (CVSS 2.4, OpenClaw ClawScan)
- [CVE-2026-89025](https://cve.now/CVE-2026-89025.md): Hirschmann HiOS Switch Platform DoS via Malformed HTTP Request (CVSS 8.7, Belden Hirschmann HiOS Switch Platform)
- [CVE-2026-59971](https://cve.now/CVE-2026-59971.md): MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure) (CVSS 10.0, designcomputer mysql\_mcp\_server · mysql-mcp-server)
- [CVE-2026-46495](https://cve.now/CVE-2026-46495.md): OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI (CVSS 9.2, OpenIdentityPlatform OpenDJ · org.openidentityplatform.o… +1)
- [CVE-2026-48722](https://cve.now/CVE-2026-48722.md): Nextflow: Incorrect default permissions in the nextflow auth login command (CVSS 5.5, nextflow-io nextflow · io.nextflow:nextflow)
- [CVE-2026-49254](https://cve.now/CVE-2026-49254.md): Dragonfly Manager OAuth provider client\_secret disclosure via unauthenticated GET /api/v1/oauth (CVSS 2.9, dragonflyoss dragonfly · d7y.io/dragonfly/v2)
- [CVE-2026-54637](https://cve.now/CVE-2026-54637.md): Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile (CVSS 5.5, dragonflyoss dragonfly · d7y.io/dragonfly/v2)
- [CVE-2026-92082](https://cve.now/CVE-2026-92082.md): Payara Server is vulnerable to brute-force login attacks due to the absence of a limit on failed login attempts (CVSS 6.3, Payara Server)
- [CVE-2026-90650](https://cve.now/CVE-2026-90650.md): MotoPress Hotel Booking \<= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id' (CVSS 7.2, jetmonsters MotoPress Hotel Booking)
- [CVE-2026-16141](https://cve.now/CVE-2026-16141.md): OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value (CVSS 8.1, OpenBMC phosphor-net-ipmid)
- [CVE-2026-16140](https://cve.now/CVE-2026-16140.md): OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1 (CVSS 8.8, OpenBMC phosphor-net-ipmid)
- [CVE-2026-77179](https://cve.now/CVE-2026-77179.md): Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback (CVSS 9.4, Docker Sandboxes)
- [CVE-2026-14805](https://cve.now/CVE-2026-14805.md): Consulting - Business, Finance WordPress Theme \<= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX (CVSS 8.8, StylemixThemes Consulting - Business, Finance WordPress The…)
- [CVE-2026-15609](https://cve.now/CVE-2026-15609.md): Bridge - Creative Multipurpose WordPress Theme \<= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle\_line' Shortcode Attribute (CVSS 6.4, QODE Bridge - Creative Multipurpose WordPress Theme)
- [CVE-2026-92079](https://cve.now/CVE-2026-92079.md): Mitigation bypass in the Widget: Win32 component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92078](https://cve.now/CVE-2026-92078.md): Denial-of-service in the Security component (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92077](https://cve.now/CVE-2026-92077.md): Denial-of-service in the SVG component (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92076](https://cve.now/CVE-2026-92076.md): Incorrect boundary conditions in the Networking component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92075](https://cve.now/CVE-2026-92075.md): Mitigation bypass in the Networking component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92074](https://cve.now/CVE-2026-92074.md): Mitigation bypass in the Popup Blocker component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92073](https://cve.now/CVE-2026-92073.md): Privilege escalation in the Enterprise Policies component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92072](https://cve.now/CVE-2026-92072.md): Incorrect boundary conditions in the Safe Browsing component (CVSS 8.0, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92071](https://cve.now/CVE-2026-92071.md): Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92070](https://cve.now/CVE-2026-92070.md): Information disclosure in the Networking component (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92069](https://cve.now/CVE-2026-92069.md): Spoofing issue in the DOM: Navigation component (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92068](https://cve.now/CVE-2026-92068.md): Site isolation issue in the Reader Mode component (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92067](https://cve.now/CVE-2026-92067.md): Use-after-free in the Widget: Gtk component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92066](https://cve.now/CVE-2026-92066.md): Sandbox escape in the Profile Backup component (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92065](https://cve.now/CVE-2026-92065.md): Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92064](https://cve.now/CVE-2026-92064.md): Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92063](https://cve.now/CVE-2026-92063.md): Denial-of-service in the Audio/Video component (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92062](https://cve.now/CVE-2026-92062.md): Privilege escalation in the Session Restore component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92061](https://cve.now/CVE-2026-92061.md): Incorrect boundary conditions in the Security: Process Sandboxing component (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92060](https://cve.now/CVE-2026-92060.md): Use-after-free in the Internationalization component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92059](https://cve.now/CVE-2026-92059.md): Incorrect boundary conditions in the DOM: Editor component (CVSS 9.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92058](https://cve.now/CVE-2026-92058.md): Use-after-free in the Graphics component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92057](https://cve.now/CVE-2026-92057.md): Mitigation bypass in the Enterprise Policies component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92056](https://cve.now/CVE-2026-92056.md): Use-after-free in the Graphics: Text component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92055](https://cve.now/CVE-2026-92055.md): Privilege escalation in the DevTools component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92054](https://cve.now/CVE-2026-92054.md): Privilege escalation in the Memory component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92053](https://cve.now/CVE-2026-92053.md): Privilege escalation in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92052](https://cve.now/CVE-2026-92052.md): Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92051](https://cve.now/CVE-2026-92051.md): Spoofing issue due to invalid pointer in the Graphics component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92050](https://cve.now/CVE-2026-92050.md): Sandbox escape due to race condition in the XPConnect component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92049](https://cve.now/CVE-2026-92049.md): Use-after-free in the Widget: Win32 component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92048](https://cve.now/CVE-2026-92048.md): Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVSS 9.0, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92047](https://cve.now/CVE-2026-92047.md): Privilege escalation in the Crash Reporting component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92046](https://cve.now/CVE-2026-92046.md): Use-after-free in the Graphics component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92045](https://cve.now/CVE-2026-92045.md): Sandbox escape due to incorrect boundary conditions in the WebRTC component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92044](https://cve.now/CVE-2026-92044.md): Information disclosure in the Networking: HTTP component (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92043](https://cve.now/CVE-2026-92043.md): Privilege escalation due to incorrect boundary conditions in the Audio/Video component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92042](https://cve.now/CVE-2026-92042.md): Race condition in the DOM: Content Processes component (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92041](https://cve.now/CVE-2026-92041.md): Mitigation bypass in the DOM: Networking component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92040](https://cve.now/CVE-2026-92040.md): Use-after-free in the JavaScript: WebAssembly component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92039](https://cve.now/CVE-2026-92039.md): Mitigation bypass in the DOM: Notifications component (CVSS 6.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92038](https://cve.now/CVE-2026-92038.md): Mitigation bypass in the Remote Settings Client component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92037](https://cve.now/CVE-2026-92037.md): Incorrect boundary conditions in the DOM: Animation component (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92036](https://cve.now/CVE-2026-92036.md): Incorrect boundary conditions in the Networking: HTTP component (CVSS 9.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92035](https://cve.now/CVE-2026-92035.md): Sandbox escape due to incorrect boundary conditions in the Graphics component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92034](https://cve.now/CVE-2026-92034.md): Site isolation issue in the Graphics component (CVSS 9.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92033](https://cve.now/CVE-2026-92033.md): Privilege escalation in Firefox for Android (CVSS 8.8, Mozilla Firefox)
- [CVE-2026-92032](https://cve.now/CVE-2026-92032.md): Sandbox escape due to invalid pointer in the Graphics component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92031](https://cve.now/CVE-2026-92031.md): Information disclosure in the Graphics: ImageLib component (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92030](https://cve.now/CVE-2026-92030.md): Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92029](https://cve.now/CVE-2026-92029.md): Use-after-free in the SVG component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92028](https://cve.now/CVE-2026-92028.md): Use-after-free in the DOM: Core & HTML component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92027](https://cve.now/CVE-2026-92027.md): Use-after-free in the DOM: Streams component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92026](https://cve.now/CVE-2026-92026.md): Use-after-free in the Networking component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92025](https://cve.now/CVE-2026-92025.md): Use-after-free in the DOM: Navigation component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92024](https://cve.now/CVE-2026-92024.md): Use-after-free in the SVG component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92023](https://cve.now/CVE-2026-92023.md): Use-after-free in the XML component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92022](https://cve.now/CVE-2026-92022.md): Use-after-free in the DOM: HTML Parser component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92021](https://cve.now/CVE-2026-92021.md): Use-after-free in the JavaScript Engine: JIT component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92020](https://cve.now/CVE-2026-92020.md): Privilege escalation due to incorrect boundary conditions in the Graphics: WebRender component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92019](https://cve.now/CVE-2026-92019.md): Mitigation bypass in the Remote Settings Client component (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92018](https://cve.now/CVE-2026-92018.md): Sandbox escape in the DOM: Core & HTML component (CVSS 9.6, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92017](https://cve.now/CVE-2026-92017.md): Privilege escalation in the DOM: Service Workers component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92016](https://cve.now/CVE-2026-92016.md): Use-after-free in the Disability Access APIs component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92015](https://cve.now/CVE-2026-92015.md): Privilege escalation in the WebExtensions component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92014](https://cve.now/CVE-2026-92014.md): Privilege escalation due to incorrect boundary conditions in the Graphics component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92013](https://cve.now/CVE-2026-92013.md): Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92012](https://cve.now/CVE-2026-92012.md): Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92011](https://cve.now/CVE-2026-92011.md): Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92010](https://cve.now/CVE-2026-92010.md): Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92009](https://cve.now/CVE-2026-92009.md): Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92008](https://cve.now/CVE-2026-92008.md): Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92007](https://cve.now/CVE-2026-92007.md): Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92006](https://cve.now/CVE-2026-92006.md): Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-92005](https://cve.now/CVE-2026-92005.md): Use-after-free in the Audio/Video: Web Codecs component (CVSS 5.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2026-91926](https://cve.now/CVE-2026-91926.md): Gss-ntlmssp: gss-ntlmssp: memory leak in ntlm\_decode\_target\_info via duplicated av\_pair entries in ntlm challenge (CVSS 3.7, Red Hat Enterprise Linux)
- [CVE-2026-89308](https://cve.now/CVE-2026-89308.md): Arbitrary command execution in TrxTimeATTENDANCE (CVSS 9.3, TREXOM TrxTimeATTENDANCE)
- [CVE-2026-92003](https://cve.now/CVE-2026-92003.md): MISP Unthrottled Authentication Failure Log Writes Enable Resource Exhaustion (CVSS 6.9, MISP)
- [CVE-2026-91998](https://cve.now/CVE-2026-91998.md): Casdoor through 4.4.0 Cross-Organization User Administration via /api/mcp (CVSS 9.4, casdoor)
- [CVE-2026-91997](https://cve.now/CVE-2026-91997.md): evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass (CVSS 6.9, evolution-foundation evolution-api)
- [CVE-2026-91996](https://cve.now/CVE-2026-91996.md): lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint (CVSS 8.7, dromara lamp-cloud)
- [CVE-2026-91995](https://cve.now/CVE-2026-91995.md): pig before 4.1.0 Unverified Password Change via /register/password (CVSS 9.3, pig-mesh pig)
- [CVE-2026-91994](https://cve.now/CVE-2026-91994.md): Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests (CVSS 7.1, semaphoreui semaphore)
- [CVE-2026-91993](https://cve.now/CVE-2026-91993.md): Jpom through 2.11.12 Workspace Isolation Bypass via /build/branch-list (CVSS 5.3, dromara Jpom)
- [CVE-2026-92002](https://cve.now/CVE-2026-92002.md): MISP: Authentication failure logging suppressed during Redis unavailability (CVSS 5.1, MISP)
- [CVE-2026-91786](https://cve.now/CVE-2026-91786.md): Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size (CVSS 6.1, Red Hat Enterprise Linux)
- [CVE-2026-91925](https://cve.now/CVE-2026-91925.md): Polyaxon through 2.16.4 Server-Side Template Injection via Unsandboxed Jinja2 Engine (CVSS 8.7, polyaxon)
- [CVE-2026-91924](https://cve.now/CVE-2026-91924.md): pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint (CVSS 8.4, sosedoff pgweb)
- [CVE-2026-91923](https://cve.now/CVE-2026-91923.md): KubeSphere through 4.1.3 SSRF via git credential verification endpoint (CVSS 8.3, kubesphere)
- [CVE-2026-91922](https://cve.now/CVE-2026-91922.md): Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render (CVSS 5.3, steedos-platform)
- [CVE-2026-1759](https://cve.now/CVE-2026-1759.md): Improper handling of insufficient permissions or privileges vulnerability in Secomea GateManager allows Privilege Escalation. (CVSS 6.5, Secomea GateManager)
- [CVE-2026-80489](https://cve.now/CVE-2026-80489.md): EUC\_JISX0213 decoding may hang on crafted input (CVSS 5.9, The GNU C Library glibc)
- [CVE-2026-1758](https://cve.now/CVE-2026-1758.md): Session Fixation (CVSS 8.3, Secomea GateManager)
- [CVE-2026-77117](https://cve.now/CVE-2026-77117.md): SHIFT\_JISX0213 decoding may hang on crafted input (CVSS 5.9, The GNU C Library glibc)
- [CVE-2026-52827](https://cve.now/CVE-2026-52827.md): Kimai: Two-factor authentication bypass on the Kimai API (CVSS 7.1, kimai · kimai/kimai)
- [CVE-2026-52822](https://cve.now/CVE-2026-52822.md): Kimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation (CVSS 5.3, kimai · kimai/kimai)
- [CVE-2026-52828](https://cve.now/CVE-2026-52828.md): Kimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access (CVSS 5.3, kimai · kimai/kimai)
- [CVE-2026-52826](https://cve.now/CVE-2026-52826.md): Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation (CVSS 5.3, kimai · kimai/kimai)
- [CVE-2026-52823](https://cve.now/CVE-2026-52823.md): Kimai: Login CSRF in Kimai Timesheet Stop and Restart API Endpoints Allows Unauthorized State Changes (CVSS 5.3, kimai · kimai/kimai)
- [CVE-2026-86818](https://cve.now/CVE-2026-86818.md): fast-uri vulnerable to mailto header injection via percent-encoded field-name desynchronization (CVSS 4.8, fast-uri)
- [CVE-2026-52824](https://cve.now/CVE-2026-52824.md): Kimai: Default APP\_SECRET in Docker Image Enables Cookie Forgery and Account Takeover (CVSS 9.1, kimai · kimai/kimai)
- [CVE-2026-52825](https://cve.now/CVE-2026-52825.md): Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility (CVSS 5.3, kimai · kimai/kimai)
- [CVE-2026-52821](https://cve.now/CVE-2026-52821.md): Kimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects (CVSS 5.3, kimai · kimai/kimai)
- [CVE-2026-52820](https://cve.now/CVE-2026-52820.md): Kimai: Timesheet PATCH/POST allows assigning to project outside user's team via query\_builder OR-bypass (CVSS 5.3, kimai · kimai/kimai)
- [CVE-2026-52819](https://cve.now/CVE-2026-52819.md): Kimai: Teamlead authorization bypass in GET /api/timesheets allows reading other users' timesheet records without being teamlead of the target (CVSS 6.3, kimai · kimai/kimai)
- [CVE-2026-57147](https://cve.now/CVE-2026-57147.md): praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery (CVSS 9.8, MervinPraison PraisonAI · MervinPraison praisonai-platfo… +1)
- [CVE-2026-57148](https://cve.now/CVE-2026-57148.md): praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard) (CVSS 9.8, MervinPraison PraisonAI · MervinPraison praisonai-platfo… +1)
- [CVE-2026-86472](https://cve.now/CVE-2026-86472.md): fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets (CVSS 4.8, fast-uri)
- [CVE-2026-57140](https://cve.now/CVE-2026-57140.md): PraisonAI AgentOS exposes unauthenticated agent listing and invocation (CVSS 9.4, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57139](https://cve.now/CVE-2026-57139.md): PraisonAI MCPServer exposes unauthenticated HTTP tools/call (CVSS 9.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57133](https://cve.now/CVE-2026-57133.md): PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining (CVSS 8.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57135](https://cve.now/CVE-2026-57135.md): PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients (CVSS 7.6, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57134](https://cve.now/CVE-2026-57134.md): PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation (CVSS 8.2, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57138](https://cve.now/CVE-2026-57138.md): PraisonAI codeMode sandbox escape via Function constructor (CVSS 9.9, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57136](https://cve.now/CVE-2026-57136.md): PraisonAI SandboxExecutor allowedCommands bypass via shell chaining (CVSS 8.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57137](https://cve.now/CVE-2026-57137.md): PraisonAI AgentLoop onToolCall approval runs after tool execution (CVSS 8.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57141](https://cve.now/CVE-2026-57141.md): PraisonAI: Remote Code Execution via Sandbox Escape in \`codeMode\` Tool (CVSS 9.8, MervinPraison PraisonAI · praisonai)
- [CVE-2026-57112](https://cve.now/CVE-2026-57112.md): PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools (CVSS 8.3, MervinPraison PraisonAI · MervinPraison praisonaiagents +2)
- [CVE-2026-48717](https://cve.now/CVE-2026-48717.md): OpenAM OAuth Authorization Bypass via PKCE Challenge (CVSS 9.1, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-47426](https://cve.now/CVE-2026-47426.md): OpenAM OAuth Client Impersonation via JWKS Resolver Cache (CVSS 7.6, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-47424](https://cve.now/CVE-2026-47424.md): OpenAM Authenticated RCE via Groovy Sandbox Escape (CVSS 7.5, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-41573](https://cve.now/CVE-2026-41573.md): OpenAM LDAP Injection via \`\_queryId\` Parameter (CVSS 7.1, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-62280](https://cve.now/CVE-2026-62280.md): OpenAM Reflected XSS in the OAuth2/OIDC \`wap\` consent page (CVSS 6.1, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2025-13166](https://cve.now/CVE-2025-13166.md): Username Enumeration via SMS OTP Flow in WSO2 Identity Server Allows User Account Discovery (CVSS 3.7, WSO2 Identity Server)
- [CVE-2025-5802](https://cve.now/CVE-2025-5802.md): Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery (CVSS 5.3, WSO2 API Manager · WSO2 API Control Plane +7)
- [CVE-2026-19515](https://cve.now/CVE-2026-19515.md): OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution (CVSS 7.0, WSO2 Integrator: MI for Visual Studio Code)
- [CVE-2026-45051](https://cve.now/CVE-2026-45051.md): OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage (CVSS 9.2, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-62263](https://cve.now/CVE-2026-62263.md): OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth\>1 bypass (CVSS 9.2, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-46623](https://cve.now/CVE-2026-46623.md): OpenAM Account Takeover via Unverified Password Change in OAuth2 Module (CVSS 7.4, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-46619](https://cve.now/CVE-2026-46619.md): OpenAM Authentication Bypass via MSISDN LDAP Injection (CVSS 9.3, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-46498](https://cve.now/CVE-2026-46498.md): OpenAM Arbitrary OAuth Token Minting via Push Registration (CVSS 7.6, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-45794](https://cve.now/CVE-2026-45794.md): OpenAM Unsafe Java Deserialization via SNS (CVSS 7.7, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-45048](https://cve.now/CVE-2026-45048.md): OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC (CVSS 8.5, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-44203](https://cve.now/CVE-2026-44203.md): OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response\_mode=form\_post via state parameter (FormPostResponse.ftl) (CVSS 8.3, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-44202](https://cve.now/CVE-2026-44202.md): OpenAM Authenticated Server-Side Request Forgery (SSRF) via \`/sessionservice\` (CVSS 5.3, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-62379](https://cve.now/CVE-2026-62379.md): OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback (CVSS 9.8, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-53660](https://cve.now/CVE-2026-53660.md): OpenAM Insecure SSO Cookie Initialization (CVSS 7.4, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-45052](https://cve.now/CVE-2026-45052.md): OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints (CVSS 9.3, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-44793](https://cve.now/CVE-2026-44793.md): OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via \`FSUtils.postToTarget\` (CVSS 7.0, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2026-91859](https://cve.now/CVE-2026-91859.md): MISP Access Log Entry Overwritten by Error Controller's Second beforeFilter Pass (CVSS 5.3, MISP)
- [CVE-2026-59341](https://cve.now/CVE-2026-59341.md): Sealed Secrets: decryption oracle via Go template injection in unauthenticated controller endpoints (CVSS 4.2, Bitnami sealed-secrets)
- [CVE-2026-91857](https://cve.now/CVE-2026-91857.md): MISP: State-changing actions accessible via GET request enabling CSRF (CVSS 5.3, MISP)
- [CVE-2026-91782](https://cve.now/CVE-2026-91782.md): GNU Binutils Dynamic Relocation Allocation elfxx-x86.c elf\_x86\_allocate\_dynrelocs null pointer dereference (CVSS 4.8, GNU Binutils)
- [CVE-2026-80217](https://cve.now/CVE-2026-80217.md): Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode o (CVSS 8.8, LITE-ON Technology FF-RFI079I4 · LITE-ON Technology FF-RFI0…)
- [CVE-2026-91851](https://cve.now/CVE-2026-91851.md): MISP Dashboard Template ACL Bypass Due to VARCHAR-to-Integer Type Coercion in Permission Flag Comparison (CVSS 5.3, MISP)
- [CVE-2026-77853](https://cve.now/CVE-2026-77853.md): Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4. (CVSS 8.8, LITE-ON Technology FF-RFI079I4 · LITE-ON Technology FF-RFI0…)
- [CVE-2026-91826](https://cve.now/CVE-2026-91826.md): Stack-based buffer overflow vulnerability in Samsung Opensource rLottie allows attackers to overflow buffers, leading to memory corruption w (CVSS 4.4, Samsung Opensource rLottie)
- [CVE-2026-76159](https://cve.now/CVE-2026-76159.md): Duplicati for Windows - Incorrect Permission Assignment for Critical Resource (CVSS 7.0, Duplicati)
- [CVE-2026-91781](https://cve.now/CVE-2026-91781.md): GNU Binutils ELF Section elf64-x86-64.c elf\_x86\_64\_common\_section\_index null pointer dereference (CVSS 4.8, GNU Binutils)
- [CVE-2026-91846](https://cve.now/CVE-2026-91846.md): MISP Collection Element Add Missing Authorization on Referenced Object UUID (CVSS 7.1, MISP)
- [CVE-2026-91780](https://cve.now/CVE-2026-91780.md): GNU Binutils elflink.c elf\_link\_add\_object\_symbols null pointer dereference (CVSS 4.8, GNU Binutils)
- [CVE-2026-75092](https://cve.now/CVE-2026-75092.md): Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan\_mysql runs mysqld --validate-config as root and can load mysql-writable plugins (CVSS 7.3, Red Hat Enterprise Linux · Red Hat OpenStack Platform)
- [CVE-2026-91779](https://cve.now/CVE-2026-91779.md): GNU Binutils Eh Frame elf-eh-frame.c \_bfd\_elf\_eh\_frame\_section\_offset null pointer dereference (CVSS 4.8, GNU Binutils)
- [CVE-2026-91825](https://cve.now/CVE-2026-91825.md): MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit (CVSS 7.1, MISP)
- [CVE-2026-91091](https://cve.now/CVE-2026-91091.md): GPAC Node Insertion base\_scenegraph.c gf\_node\_list\_insert\_child memory corruption (CVSS 5.3, GPAC)
- [CVE-2026-91819](https://cve.now/CVE-2026-91819.md): MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent (CVSS 6.9, MISP)
- [CVE-2026-91090](https://cve.now/CVE-2026-91090.md): GPAC base\_scenegraph.c gf\_node\_activate\_ex stack-based overflow (CVSS 2.4, GPAC)
- [CVE-2026-91089](https://cve.now/CVE-2026-91089.md): GPAC base\_scenegraph.c gf\_node\_get\_name\_and\_id use after free (CVSS 5.3, GPAC)
- [CVE-2026-91778](https://cve.now/CVE-2026-91778.md): In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the (CVSS 7.2, Octopus Deploy Octopus Server)
- [CVE-2026-18063](https://cve.now/CVE-2026-18063.md): Job Postings \<= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position\_button' Parameter (CVSS 6.4, blueglassch Job Postings)
- [CVE-2026-91088](https://cve.now/CVE-2026-91088.md): GPAC URL url.c gf\_url\_concatenate\_ex heap-based overflow (CVSS 2.4, GPAC)
- [CVE-2026-91087](https://cve.now/CVE-2026-91087.md): GPAC Compositor media\_object.c gf\_mo\_get\_od\_id use after free (CVSS 6.9, GPAC)
- [CVE-2026-91086](https://cve.now/CVE-2026-91086.md): GPAC MPEG Video Reframer reframe\_mpgvid.c mpgviddmx\_process heap-based overflow (CVSS 5.3, GPAC)
- [CVE-2026-90711](https://cve.now/CVE-2026-90711.md): proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet (CVSS 9.1, proxy-addr)
- [CVE-2026-91005](https://cve.now/CVE-2026-91005.md): SourceCodester Online Faculty Clearance System Profile Picture Upload edit\_picture.php move\_uploaded\_file unrestricted upload (CVSS 5.3, SourceCodester Online Faculty Clearance System)
- [CVE-2026-75983](https://cve.now/CVE-2026-75983.md): Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce \<= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map\_meta\_cap Filter (CVSS 7.5, arraytics Eventin – Event Calendar, Tickets, Registration,…)
- [CVE-2026-15402](https://cve.now/CVE-2026-15402.md): Eventin \<= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn\_shedule\_objective' schedule\_slot Parameter (CVSS 6.4, arraytics Eventin – Event Calendar, Tickets, Registration,…)
- [CVE-2026-89141](https://cve.now/CVE-2026-89141.md): AI Engine \<= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter (CVSS 6.5, tigroumeow AI Engine – The Chatbot, AI Framework & MCP for…)
- [CVE-2026-91004](https://cve.now/CVE-2026-91004.md): SourceCodester Online Faculty Clearance System delete\_faculty1.php sql injection (CVSS 6.9, SourceCodester Online Faculty Clearance System)
- [CVE-2026-18232](https://cve.now/CVE-2026-18232.md): WP Directory Kit \<= 1.5.7 - Unauthenticated Unpublished Listing Disclosure via map\_infowindow (CVSS 5.3, WP Directory Kit)
- [CVE-2026-16592](https://cve.now/CVE-2026-16592.md): WP Directory Kit \<= 1.5.7 - Contributor+ Non-Public Listing Field Disclosure via Shortcodes (CVSS 2.7, WP Directory Kit)
- [CVE-2026-16593](https://cve.now/CVE-2026-16593.md): WP Directory Kit \<= 1.5.7 - Editor+ SQL Injection via Elementor Category and Location Widget Settings (CVSS 6.8, WP Directory Kit)
- [CVE-2026-86701](https://cve.now/CVE-2026-86701.md): Android application "ManabiPocket for Parents" contains an improper access control vulnerability in one of its components. (CVSS 2.5, NTT DOCOMO BUSINESS ManabiPocket for Parents)
- [CVE-2026-91003](https://cve.now/CVE-2026-91003.md): D-Link DI-8300 CGI Service rzgl.asp rzgl\_asp stack-based overflow (CVSS 9.4, D-Link DI-8300)
- [CVE-2026-17495](https://cve.now/CVE-2026-17495.md): moment vulnerable to Path Traversal via crafted non-string locale name (CVSS 5.9, moment)
- [CVE-2026-81320](https://cve.now/CVE-2026-81320.md): Hawtio-operator: hawtio-operator: tls private key written to operator log at debug level (CVSS 5.5, Red Hat build of Apache Camel - HawtIO)
- [CVE-2026-81303](https://cve.now/CVE-2026-81303.md): Hawtio-operator: hawtio-operator: routes/custom-host confused-deputy via spec.routehostname (CVSS 6.3, Red Hat build of Apache Camel - HawtIO)
- [CVE-2026-91002](https://cve.now/CVE-2026-91002.md): stamparm maltrail Blacklist Endpoint httpd.py \_blacklist missing authentication (CVSS 6.9, stamparm maltrail)
- [CVE-2026-91001](https://cve.now/CVE-2026-91001.md): D-Link DI-8400 DDNS Configuration ddns.asp ddns\_asp stack-based overflow (CVSS 9.4, D-Link DI-8400)
- [CVE-2026-15758](https://cve.now/CVE-2026-15758.md): 3D FlipBook \<= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter (CVSS 5.3, iberezansky 3D FlipBook – PDF Embedder, PDF Flipbook Viewer…)
- [CVE-2026-90881](https://cve.now/CVE-2026-90881.md): D-Link DIR-882 CGI Binary dllog.cgi main information disclosure (CVSS 6.9, D-Link DIR-882)
- [CVE-2026-90880](https://cve.now/CVE-2026-90880.md): D-Link DSL-3782 Diagnostics Diagnostics.asp system command injection (CVSS 5.3, D-Link DSL-3782)
- [CVE-2026-90879](https://cve.now/CVE-2026-90879.md): zyx0814 FilePress Publish search.php sql injection (CVSS 6.9, zyx0814 FilePress)
- [CVE-2026-90878](https://cve.now/CVE-2026-90878.md): vllm-project vLLM Jinja Template Rendering completions resource consumption (CVSS 5.3, vllm-project vLLM)
- [CVE-2026-90877](https://cve.now/CVE-2026-90877.md): SourceCodester Online Faculty Clearance System update\_requirement\_status.php sql injection (CVSS 6.9, SourceCodester Online Faculty Clearance System)
- [CVE-2026-90876](https://cve.now/CVE-2026-90876.md): SourceCodester Online Faculty Clearance System delete\_requirement.php sql injection (CVSS 6.9, SourceCodester Online Faculty Clearance System)
- [CVE-2026-90858](https://cve.now/CVE-2026-90858.md): subhajitkhan online-clinic-management-system adminappview.php session\_start authorization (CVSS 6.9, subhajitkhan online-clinic-management-system)
- [CVE-2026-90857](https://cve.now/CVE-2026-90857.md): SourceCodester College Notes Gallery Management System Profile Upload userprofile.php unrestricted upload (CVSS 5.3, SourceCodester College Notes Gallery Management System)
- [CVE-2026-90856](https://cve.now/CVE-2026-90856.md): SourceCodester College Notes Gallery Management System Registration Flow signup.php privileges management (CVSS 6.9, SourceCodester College Notes Gallery Management System)
- [CVE-2026-90855](https://cve.now/CVE-2026-90855.md): SourceCodester/katojkalemba Online Food Ordering System order.php sql injection (CVSS 6.9, SourceCodester Online Food Ordering System · katojkalemba O…)
- [CVE-2026-90854](https://cve.now/CVE-2026-90854.md): SourceCodester/katojkalemba Online Food Ordering System category-foods.php sql injection (CVSS 6.9, SourceCodester Online Food Ordering System · katojkalemba O…)
- [CVE-2026-88262](https://cve.now/CVE-2026-88262.md): Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass. (CVSS 8.7, bizwell xClick)
- [CVE-2026-90852](https://cve.now/CVE-2026-90852.md): luben zstd-jni Dictionary Sharing ZstdCompressCtx.java ZstdCompressCtx.loadDict use after free (CVSS 6.9, luben zstd-jni)
- [CVE-2026-88261](https://cve.now/CVE-2026-88261.md): Improper input validation vulnerability in bizwell xClick allows Stored XSS. (CVSS 5.1, bizwell xClick)
- [CVE-2026-90851](https://cve.now/CVE-2026-90851.md): PHPGurukul Hostel Management System checklogin.php access control (CVSS 5.3, PHPGurukul Hostel Management System)
- [CVE-2026-90850](https://cve.now/CVE-2026-90850.md): PHPGurukul Hostel Management System manage-students.php cross site scripting (CVSS 4.8, PHPGurukul Hostel Management System)
- [CVE-2026-90849](https://cve.now/CVE-2026-90849.md): SourceCodester College Notes Gallery Management System login.php sql injection (CVSS 6.9, SourceCodester College Notes Gallery Management System)
- [CVE-2026-91774](https://cve.now/CVE-2026-91774.md): Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint (CVSS 5.3, YaoApp yao)
- [CVE-2026-91773](https://cve.now/CVE-2026-91773.md): Soft Serve 0.7.1 through 0.11.6 Information Disclosure via LFS Locks (CVSS 5.3, charmbracelet soft-serve)
- [CVE-2026-91772](https://cve.now/CVE-2026-91772.md): Halo through 2.26.1 Open Redirect via Unvalidated URI Parameter (CVSS 6.1, halo-dev halo)
- [CVE-2026-91771](https://cve.now/CVE-2026-91771.md): Weights & Biases wandb before 0.29.0 Path Traversal via File Download (CVSS 8.8, wandb)
- [CVE-2026-91770](https://cve.now/CVE-2026-91770.md): IceHRM before 36.0.0 Broken Access Control via Employee ID (CVSS 7.1, gamonoid icehrm)
- [CVE-2026-90848](https://cve.now/CVE-2026-90848.md): Governikus AusweisApp StartPAOSResponse cross site scripting (CVSS 5.3, Governikus AusweisApp)
- [CVE-2026-85657](https://cve.now/CVE-2026-85657.md): Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors \<= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile\_fields\_user\_email\_value\_prefix' Parameter (CVSS 5.4, Co-Authors, Multiple Authors and Guest Authors in an Author…)
- [CVE-2026-85575](https://cve.now/CVE-2026-85575.md): The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets \<= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine\_product\_title\_header\_size' Parameter (CVSS 6.4, roxnor ShopEngine Elementor WooCommerce Builder Addon – All…)
- [CVE-2026-90847](https://cve.now/CVE-2026-90847.md): EFM ipTIME C200E System Setup iux\_set.cgi os command injection (CVSS 9.4, EFM ipTIME C200E)
- [CVE-2026-90846](https://cve.now/CVE-2026-90846.md): PHPGurukul Daily Expense Tracker System forgot-password.php sql injection (CVSS 6.9, PHPGurukul Daily Expense Tracker System)
- [CVE-2026-91752](https://cve.now/CVE-2026-91752.md): GNU libextractor before 1.15 Stack Overflow via OLE2 (CVSS 8.7, GNU libextractor)
- [CVE-2026-91751](https://cve.now/CVE-2026-91751.md): Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API (CVSS 7.2, flextype)
- [CVE-2026-91750](https://cve.now/CVE-2026-91750.md): WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects (CVSS 7.1, Tencent WeKnora)
- [CVE-2026-90845](https://cve.now/CVE-2026-90845.md): PHPGurukul Daily Expense Tracker System sidebar.php cross site scripting (CVSS 5.1, PHPGurukul Daily Expense Tracker System)
- [CVE-2026-90844](https://cve.now/CVE-2026-90844.md): PHPGurukul Daily Expense Tracker System Login index.php sql injection (CVSS 6.9, PHPGurukul Daily Expense Tracker System)
- [CVE-2026-90843](https://cve.now/CVE-2026-90843.md): SabyasachiRana WebMap New Nmap Scan functions\_nmap.py nmap\_newscan os command injection (CVSS 6.9, SabyasachiRana WebMap)
- [CVE-2025-66974](https://cve.now/CVE-2025-66974.md): An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial (CVSS 7.5)
- [CVE-2026-25825](https://cve.now/CVE-2026-25825.md): An issue was discovered in Keyfactor SignServer before 7.6.0. (CVSS 2.7)
- [CVE-2026-25826](https://cve.now/CVE-2026-25826.md): An issue was discovered in Keyfactor SignServer before 7.6.0. (CVSS 4.9)
- [CVE-2026-25827](https://cve.now/CVE-2026-25827.md): An issue was discovered in Keyfactor SignServer before 7.6.0. (CVSS 2.3)
- [CVE-2026-37152](https://cve.now/CVE-2026-37152.md): TOTOLINK X5000R V9.1.0cu.2415\_B20250515 was discovered to contain a hardcoded password for root access. (CVSS 9.8)
- [CVE-2026-39038](https://cve.now/CVE-2026-39038.md): BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in Gener (CVSS 6.1)
- [CVE-2026-39039](https://cve.now/CVE-2026-39039.md): In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the brow (CVSS 5.3)
- [CVE-2026-39040](https://cve.now/CVE-2026-39040.md): BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in Expre (CVSS 5.4)
- [CVE-2026-51133](https://cve.now/CVE-2026-51133.md): Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance \<= V6.0104 allows a remote attacker to execute arbitrary cod (CVSS 6.1)
- [CVE-2026-51134](https://cve.now/CVE-2026-51134.md): The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml (CVSS 7.5)
- [CVE-2026-52484](https://cve.now/CVE-2026-52484.md): An issue in MitraStar GPT-2742GX4X5v6-SV GL\_g2.5\_100XNT0b23\_3 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/de (CVSS 8.8)
- [CVE-2026-79303](https://cve.now/CVE-2026-79303.md): kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. (CVSS 9.9)
- [CVE-2026-79409](https://cve.now/CVE-2026-79409.md): An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfi (CVSS 6.5)
- [CVE-2026-79410](https://cve.now/CVE-2026-79410.md): Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce thei (CVSS 8.1)
- [CVE-2026-79411](https://cve.now/CVE-2026-79411.md): Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding o (CVSS 8.8)
- [CVE-2026-79425](https://cve.now/CVE-2026-79425.md): An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online\_upload component of CRMEB v6.0.0 allows attackers to scan i (CVSS 8.1)
- [CVE-2026-79551](https://cve.now/CVE-2026-79551.md): Tenda Technology Co., Ltd NVR\_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key. (CVSS 7.5)
- [CVE-2026-88616](https://cve.now/CVE-2026-88616.md): An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTas (CVSS 8.8)
- [CVE-2026-88617](https://cve.now/CVE-2026-88617.md): SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. (CVSS 9.8)
- [CVE-2026-88618](https://cve.now/CVE-2026-88618.md): 1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. (CVSS 6.5)
- [CVE-2026-88619](https://cve.now/CVE-2026-88619.md): 1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. (CVSS 8.1)
- [CVE-2026-88620](https://cve.now/CVE-2026-88620.md): SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. (CVSS 4.3)
- [CVE-2026-88621](https://cve.now/CVE-2026-88621.md): OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. (CVSS 2.7)
- [CVE-2026-88742](https://cve.now/CVE-2026-88742.md): Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field. (CVSS 5.4)
- [CVE-2026-88743](https://cve.now/CVE-2026-88743.md): Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags. (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.