ROOT-OS-ALPINE-321-CVE-2026-6276 CVE-2026-6276 in curl - Patched by Root

Root has patched CVE-2026-6276 in the curl package for Root:Alpine:3.21. Multiple fixed versions available...

ROOT-OS-ALPINE-321-CVE-2026-3805 CVE-2026-3805 in curl - Patched by Root

Root has patched CVE-2026-3805 in the curl package for Root:Alpine:3.21. Multiple fixed versions available...

ROOT-OS-ALPINE-322-CVE-2026-6276 CVE-2026-6276 in curl - Patched by Root

Root has patched CVE-2026-6276 in the curl package for Root:Alpine:3.22. Multiple fixed versions available...

Atlassian Bitbucket - Remote Command Injection

Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain...

CVE-2026-14311: Missing Authorization

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/ endpoint in all versions up to, and including, 2.4.4. This makes it possible for authenticated...

EUVD-2026-42267

Grav: Stored CSS injection via Markdown image resize bypasses prior media style sanitizers in Grav...

CVE-2026-77405 RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when...

HTTP File Server <2.3c - Remote Command Execution

HTTP File Server before 2.3c is susceptible to remote command execution. The findMacroMarker function in parserLib.pas allows an attacker to execute arbitrary programs via a %00 sequence in a search action. Therefore, an attacker can obtain sensitive information, modify data, and/or gain full...

CVE-2026-92364

itsourcecode Leave Management System 1.0 is affected by a SQL injection vulnerability in the file /module/employee/index.php, where manipulation of the ID argument allows an attacker to inject SQL commands. The attack can be initiated remotely and requires low privileges (authenticated access), w...

CVE-2026-88065 `tts-be` application has a Broken Access Control vulnerability

tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...

CVE-2026-87274

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.16. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle...

CVE-2026-87270

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle V...

CVE-2026-87259

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain component: Engineering Communication Interface. The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Orac...

CVE-2026-87215

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial...

CVE-2026-87203

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial...

CVE-2026-87146

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion component: Access and security. The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-83420

Vulnerability in the PeopleSoft Enterprise FIN Engineering Brazil product of Oracle PeopleSoft component: Engineering. The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN...

CVE-2026-83277

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain component: CAX Client. The supported version that is affected is 3.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM MCAD Connector executes...

CVE-2026-83252

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

CVE-2026-83246

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...