CVE-2026-83169

CVE-2026-83169 affects Oracle One-to-One Fulfillment (component: Java Server Issues ) within Oracle E-Business Suite, versions 12.2.3 through 12.2.15 . The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the product, resulting in a takeover (high impact...

CVE-2026-73954

CVE-2026-73954 is a vulnerability in the Business Interlink component of Oracle PeopleSoft Enterprise PeopleTools , affecting supported versions 8.61–8.63 . An unauthenticated attacker with network access via HTTP can exploit this flaw, though the attack complexity is rated high (difficult to exp...

EUVD-2026-79507

Vulnerability in the Oracle GraalVM product of Oracle Java SE component: Compiler. The supported version that is affected is Oracle GraalVM: 25.0.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle GraalVM. Successful attacks o...

CVE-2024-4577

이것은 CVE-2024-4577의 POC입니다. 이 익스플로잇을 통해 공격자는 RCE 를 수행할 수 있습니다. PHP 8.3 8.3.8, PHP 8.2 8.2.20, PHP 8.1 8.1.29과 같은 PHP 버전에서 인수는 코드에서 확인할 수 있습니다! 이 특정 익스플로잇에 대한 자세한 내용은 nist.gov에서 확인하세요...

CVE-2025-48827

CVE-2025-48827 - vBulletin 인증 우회 익스플로잇 개요 이 저장소는 PHP 8.1 이상에서 실행되는 vBulletin 5.0.0–5.7.5 및 6.0.0–6.0.3에 영향을 미치는 중요한 인증 우회 취약점인 CVE-2025-48827에 대한 개념 증명 익스플로잇을 포함합니다. 이 취약점을 통해 인증되지 않은 공격자가 보호된 API 메서드를 원격으로 호출할 수 있으며, 잠재적으로 원격 코드 실행과 전체 시스템 손상으로 이어질 수 있습니다. 작성자: pszyszkowski 심각도: 치명적 CVE:...

CVE-2025-48827

설명: PHP 8.1을 사용하는 Vbullettin 5.0.0 - 5.7.5 및 6.0.0 - 6.0.3 버전을 위한 RCE 기능: 멀티 스레드 파일로부터 여러 대상 읽기 Vbulletin 웹사이트 탐지 취약점 확인, 성공 시 PHP 웹쉘 업로드 사용 방법 상세: usage: CVE-2025-48827.py -h --url URL --list LIST --threads THREADS --timeout TIMEOUT vBulletin 대상에서 쉘을 식별하고 업로드합니다. 선택적 인수: -h, --help 이 도움말 메시지를 표시...

UBUNTU-CVE-2026-30754

A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nalsend function in libavformat/rtpench264hevc.c, a negative size parameter size=-3 is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using...

CVE-2026-30754

A memory corruption vulnerability exists in FFmpeg before 8.1. The RTP encoding process. In the nalsend function in libavformat/rtpench264hevc.c, a negative size parameter size=-3 is passed to memcpy when transmitting H.264/HEVC streams via RTP using a crafted input file. This was detected using...

EUVD-2026-71775

In Ignition 8.1.53 and earlier, the Gateway "Create Project Roles" setting shipped blank, which permitted any authenticated user to create projects if they can execute gateway scripts. Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3...

Important: Red Hat Security Advisory: Red Hat Ceph Storage

A new version of Red Hat build of Ceph Storage has been released The Red Hat Storage Ceph container images are based on the latest ubi9 base image and Ceph 8.1. This release updates to the latest version...

Astra Linux – Vulnerability in PHP 8.1

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, and 8.3. before 8.3.12, when using PHP-FPM SAPI and the option catchworkersoutput is set to yes, it is possible to manipulate the log messages by removing up to 4 characters from the log messages. Additionally, if PHP-FPM is configured to us...

GHSA-8XJM-WQRP-2F25 Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

Summary HasUploadFields::uploadMultipleFilesToDisk in src/app/Models/Traits/HasUploadFields.php reads file paths from the clear request input and deletes them from the configured storage disk without verifying that the paths belong to the current model record. An authenticated user with Update...

CVE-2026-63722

ICEcoder 8.1 is vulnerable to unauthenticated remote code execution via the terminal-xhr.php endpoint. Attackers chain three flaws: a password parameter bypasses authentication, a non-empty csrf parameter skips CSRF validation, and an arbitrary command string is passed directly to proc_open(), yi...

EUVD-2026-62698

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the...

CVE-2026-63722 ICEcoder 8.1 Unauthenticated RCE via terminal-xhr.php

ICEcoder 8.1 contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by chaining an authentication bypass, CSRF validation bypass, and unsanitized command execution. Attackers can send a single HTTP POST request to the...

CVE-2026-71110

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. Supported versions that are affected are 1.0.0-1.4.18, 3.0.0-3.2.17 and 4.0.0-4.4.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise...

CVE-2026-71112

Vulnerability in the PeopleSoft Enterprise FIN Common Objects product of Oracle PeopleSoft component: Security. The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN...

CVE-2026-71068

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain component: CAX Client. The supported version that is affected is 3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM MCAD Connector...

CVE-2026-71035

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

CVE-2026-70999

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Experience Manager. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...