EUVD-2026-84152

Stencil core 4.43.5 contains a DOM-based cross-site scripting XSS vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textContent property of such a component's host element causes t...

CVE-2026-79320

Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime . The issue occurs when a downstream application enables the experimental slot fixes option and utilizes scoped components . Specifically, assigning a string to the textContent property of a...

Autodesk Shared Components < 1.12.0 / 2.x < 2.2.0 DoS (adsk-sa-2026-0015)

The version of Autodesk Shared Components installed on the remote Windows host is prior to 1.12.0, or 2.x prior to 2.2.0. It is, therefore, affected by an uncontrolled recursion vulnerability. A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontroll...

CVE-2026-82561

Apache NiFi versions 1.5.0 through 2.11.0 contain a missing authorization flaw in REST API methods used for Process Group flow replacement and versioned flow update/rebase operations. These methods only checked read/write permissions on the Process Group itself, unlike their asynchronous counterp...

Oracle Critical Security Patch Update, September 2026 Review

Oracle released its September edition of Critical Security Patch Update. The update received patches for 673 security vulnerabilities. Some of the vulnerabilities addressed in this update impact more than one product. These patches address vulnerabilities in various product families, including...

EUVD-2026-80393

A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basicfunctions.ts of the component Update Components. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The project was informe...

CVE-2026-92356

A resource consumption vulnerability exists in a2ui-project a2ui versions 0.9 and 0.9.1 , affecting the updateComponents function in the file basic_functions.ts (component: Update Components). A remote attacker with low privileges can trigger excessive resource consumption through a manipulation ...

EUVD-2026-80039

Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including routingtabaddcgi, routingtablelistshowcgi, routepolicyaddcgi, and routepolicyparameshowcgi. Attackers can inject persistent script payloads...

RHEL 9 : opentelemetry-collector (RHSA-2026:67975)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67975 advisory. Collector with the supported components for a Red Hat build of OpenTelemetry Security Fixes: net/mail: golang: net/mail: Denial of Service...

PT-2026-93691

Name of the Vulnerable Software and Affected Versions a2ui versions 0.9 through 0.9.1 Description A remote manipulation of the updateComponents function within the basic functions.ts file of the Update Components component can lead to excessive resource consumption. Recommendations At the moment,...

Information Exposure

Overview bagisto/bagisto is a hand tailored E-Commerce framework designed on some opensource technologies such as Laravel a PHP framework, Vue.js a progressive Javascript framework. Affected versions of this package are vulnerable to Information Exposure in the add-to-cart API and the downloadabl...

CVE-2026-83067

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware component: ADF Shared Components. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-83067

Oracle JDeveloper (Oracle Fusion Middleware, component ADF Shared Components ) in versions 12.2.1.4.0 and 14.1.2.0.0 is affected by an easily exploitable vulnerability allowing a low-privileged attacker with network access via HTTP to compromise the application. Successful exploitation can lead t...

EUVD-2026-79395

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware component: ADF Shared Components. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

ROS-20260915-73-0169

The vulnerability of the IME components in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

PT-2026-92591

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware component: ADF Shared Components. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

PT-2026-92913

Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite component: Common Components. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

PT-2026-92122

Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting XSS in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently validated by the link filter and was rendered withou...

ROS-20260915-73-0007

The vulnerability of the CSS components in Google Chrome and Microsoft Edge relates to the manipulation of inter-site requests. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data through a specially created HTML page...

ROS-20260915-73-0043

The vulnerability of the Codecs components in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure using a specially created video file...