CVE-2026-69200: Improperly Controlled Modification of Object Prototype Attributes

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarmsandconditions/clientalarm.ts directly assigns unsanitized field names and allows a proto.pollutedKey path to modify...

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents allows a intruder to gain full control over the system.

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker...

CVE-2026-86792: Use of Externally-Controlled Input to Select Classes or Code

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via importstring, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments that have enabled the Kafk...

CVE-2026-75516: Allocation of Resources Without Limits or Throttling

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQConnection.start applies Math.minmaxInboundMessageBodySize, frameMax after Connection.Tune negotiation even though AMQP defines frameMax value zero as...

openSUSE 16 Security Update : keybase-client (openSUSE-SU-2026:21846-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21846-1 advisory. Changes in keybase-client: - CVE-2026-56855,CVE-2026-56854,CVE-2026-78662: authentication bypass and deadlocks in the crypto/ssh library Add...

Linux Distros Unpatched Vulnerability : CVE-2026-92038

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153....

CVE-2026-81855

A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard...

CVE-2026-81855

A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard , a marine engine management platform. An attacker with network access and no prior privileges can exploit this to gain high confidentiality and high integrity...

CVE-2026-81855 Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key

A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard...

CVE-2026-81855 Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key

A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard...

CVE-2026-81926

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation through the CookieJar middleware accepting and storing a response cookie's Domain attribute without verifying that it matches the host that supplied the cookie or rejecting public suffixes. An attacker can cause cookies...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation through the CookieJar middleware accepting and storing a response cookie's Domain attribute without verifying that it matches the host that supplied the cookie or rejecting public suffixes. An attacker can cause cookies...

Reliance on Cookies without Validation and Integrity Checking

Overview Affected versions of this package are vulnerable to Reliance on Cookies without Validation and Integrity Checking via the CookieJar process. An attacker can access sensitive session or authentication cookies by influencing outbound requests to attacker-controlled hostnames, leading to...

Reliance on Cookies without Validation and Integrity Checking

Overview Affected versions of this package are vulnerable to Reliance on Cookies without Validation and Integrity Checking via the CookieJar process. An attacker can access sensitive session or authentication cookies by influencing outbound requests to attacker-controlled hostnames, leading to...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the FollowRedirect process. An attacker can intercept sensitive credentials by inducing a redirect from HTTPS to HTTP on the same authority and observing the network traffic. Remediation Upgrade...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the FollowRedirect process. An attacker can intercept sensitive credentials by inducing a redirect from HTTPS to HTTP on the same authority and observing the network traffic. Remediation Upgrade...

CVE-2026-88742

Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in the client address field...

CVE-2026-87253

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Web Client. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require hum...

CVE-2026-83339

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware component: Client Bundle. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...