EUVD-2026-37400

Vulnerability in the Identity Manager product of Oracle Fusion Middleware component: REST WebServices. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager...

Exploit for CVE-2026-49060

CVE-2026-49060 - Hippoo Mobile App for WooCommerce Incorrect P...

CVE-2026-8383

The LearnPress WordPress plugin (versions prior to 4.3.7 ) is vulnerable to an information disclosure flaw due to a missing capability check on a REST endpoint. The edit context is not properly restricted by the edit_users capability, allowing unauthenticated visitors to retrieve sensitive data, ...

CVE-2026-8383 LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API

The LearnPress WordPress plugin before 4.3.7 does not gate the edit context on one of its REST endpoint behind the editusers capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted...

CVE-2026-8383 LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API

The LearnPress WordPress plugin before 4.3.7 does not gate the edit context on one of its REST endpoint behind the editusers capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted...

CVE-2026-35267: Undefined Security Weakness

Vulnerability in the Identity Manager product of Oracle Fusion Middleware component: REST WebServices. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Identity Manager...

io.quarkus:quarkus-rest-servlet (3.37.0.cr1), io.quarkus:quarkus-rest-servlet-deployment (3.37.0.cr1) +1 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-undertow (3.37.0.cr1)

io.quarkus:quarkus-undertow MAVEN version 3.37.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-undertow and may be impacted: - io.quarkus:quarkus-rest-servlet 3.37.0.cr1 - io.quarkus:quarkus-rest-servlet-deployment 3.37.0.cr1 -...

Path Equivalence

Overview Affected versions of this package are vulnerable to Path Equivalence in the pathWithoutMatrixParams of AbstractPathMatchingHttpSecurityPolicy via specially crafted HTTP requests containing encoded semicolons, slashes, or backslashes in the request path. An attacker can gain unauthorized...

io.quarkiverse.renarde:quarkus-renarde (>=3.1.7, <=3.1.10), io.quarkiverse.renarde:quarkus-renarde-backoffice (>=3.1.7, <=3.1.10) +13 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (>=3.34.0.cr1, <=3.36.2)

io.quarkus:quarkus-rest-csrf MAVEN version =3.34.0.cr1, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.1.7, =3.34.0.cr1, =3.36.2 Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375079...

io.quarkiverse.renarde:quarkus-renarde (>=3.1.0, <=3.1.3), io.quarkiverse.renarde:quarkus-renarde-backoffice (>=3.1.0, <=3.1.3) +13 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (>=3.21.0.cr1, <=3.27.4)

io.quarkus:quarkus-rest-csrf MAVEN version =3.21.0.cr1, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.1.0, =3.21.0.cr1, =3.27.4 Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375079...

Drupal core - Moderately critical - Improper validation - SA-CORE-2026-009

The JSON:API and REST modules allow you to upload image files to image fields. The validation rules check the file extension of the uploaded file but not the file MIME type. This may allow a malicious user to upload a file that is not an image. Certain web-server configurations may serve the...

CVE-2026-35269: Undefined Security Weakness

Vulnerability in the Identity Manager product of Oracle Fusion Middleware component: REST WebServices. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager...

PT-2026-50244

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.3.7 Description An information disclosure issue exists where the edit context on a REST endpoint is not properly restricted by the edit users capability. This allows unauthenticated visitors to retrieve sensitive...

CVE-2026-8383: Undefined Security Weakness

The LearnPress WordPress plugin before 4.3.7 does not gate the edit context on one of its REST endpoint behind the editusers capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, locale, and registration date via a crafted...

io.quarkus:quarkus-rest-csrf-deployment (3.37.0.cr1) potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (3.37.0.cr1)

io.quarkus:quarkus-rest-csrf MAVEN version 3.37.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-rest-csrf and may be impacted: - io.quarkus:quarkus-rest-csrf-deployment 3.37.0.cr1 Source cves: CVE-2026-50559 Source advisory:...

io.quarkiverse.renarde:quarkus-renarde (>=3.0.13, <=3.0.20), io.quarkiverse.renarde:quarkus-renarde-backoffice (>=3.0.13, <=3.0.20) +14 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (>=3.9.0.cr1, <=3.20.6.1)

io.quarkus:quarkus-rest-csrf MAVEN version =3.9.0.cr1, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.13, =3.0.20 and more Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375079...

io.quarkiverse.renarde:quarkus-renarde (>=3.1.4, <=3.1.6), io.quarkiverse.renarde:quarkus-renarde-backoffice (>=3.1.4, <=3.1.6) +13 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-rest-csrf (>=3.28.0.cr1, <=3.33.2)

io.quarkus:quarkus-rest-csrf MAVEN version =3.28.0.cr1, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.1.4, =3.28.0.cr1, =3.33.2 Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375079...

EUVD-2026-37199

The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands e.g. system reboot...

CVE-2026-22313

The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability an authenticated attacker can send arbitrary commands to the device that are executed with administrative permissions by the underlying...

CVE-2026-22312

The device has a webserver that exposes a REST API authenticated with a constant token. The unauthenticated API can be used by an attacker to get access to system settings, modify the configuration and execute some commands e.g. system reboot...