grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6 allow-list default

A flaw in Grafana's Auth Proxy IPv6 allow-list incorrectly defaults to a broad /32 subnet mask instead of a strict /128. This misconfiguration allows remote attackers to bypass access restrictions, potentially leading to unauthorized access and data manipulation...

The vulnerability of the WebLogic Server Proxy Plug-In for third-party web servers within the Oracle Fusion Middleware software platform allows a malicious individual to gain unauthorized access to create, delete, or modify data.

The vulnerability of the WebLogic Server Proxy Plug-In for third-party web servers within the Oracle Fusion Middleware software platform is related to access control errors. Exploiting this vulnerability could allow an attacker to gain unauthorized access to create, delete, or modify data using t...

CVE-2026-87153

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub...

CVE-2026-83428

Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand...

CVE-2026-83307

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: BI Platform Security. Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle B...

CVE-2026-83027

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attach...

CVE-2026-87252

CVE-2026-87252 affects Oracle Agile PLM (Oracle Supply Chain, component: Application Server ), version 9.3.6 . The vulnerability allows an unauthenticated attacker with access to the physical communication segment attached to the hardware where Agile PLM executes to compromise the application. It...

EUVD-2026-79828

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial...

CVE-2026-87154

CVE-2026-87154 affects the Oracle Product Hub component (Internal Operations ) of Oracle E-Business Suite , versions 12.2.3 through 12.2.15 . An easily exploitable vulnerability allows a low-privileged attacker with network access via HTTP to compromise the Product Hub without user interaction. S...

EUVD-2026-79780

Vulnerability in the Oracle Financials for Asia/Pacific product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.8-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-83434

CVE-2026-83434 affects the Oracle Product Workbench component (Internal Operations) of Oracle E-Business Suite , versions 12.2.3 through 12.2.15 . A low-privileged attacker with network access via HTTP can exploit this vulnerability to perform unauthorized creation, deletion, modification, and re...

CVE-2026-83304

Oracle Business Intelligence Enterprise Edition (component: Analytics Web General ) in Oracle Analytics is vulnerable via unauthenticated network access over HTTP. Affected supported versions are 8.2.0.0.0 , 12.2.1.4.0 , and 26.01.0.0.0 . The vulnerability is rated HIGH (CVSS 3.1: 8.9 , vector AV...

EUVD-2026-79629

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain component: CAX Client. The supported version that is affected is 3.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM MCAD Connector executes...

EUVD-2026-79592

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle...

CVE-2026-83089

Oracle Alert (component: Internal Operations) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is vulnerable to a network-based attack. A low-privileged attacker with HTTP access can exploit this vulnerability to gain unauthorized creation, deletion, or modification of critical data, as...

CVE-2026-73944

Oracle Access Manager (Oracle Fusion Middleware, component: Authentication Engine ) versions 12.2.1.4.0 and 14.1.2.1.0 are affected by a critical vulnerability (CVSS 3.1 base score 9.1 ). An unauthenticated attacker with network access via HTTP can create, delete, or modify data and gain complete...

openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes

A flaw was found in OpenSSL. The implementations of AES-SIV Advanced Encryption Standard - SIV and AES-GCM-SIV Advanced Encryption Standard - Galois/Counter Mode - SIV incorrectly process authentication tags for empty messages. This vulnerability allows a remote attacker to forge empty messages...

PT-2026-93021

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Financial Management version 11.2.26.0.000 Description A security flaw in the Security component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to...

PT-2026-92613

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Alert versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component of Oracle Alert allows a low privileged attacker with network access via HTTP to compromise the system. Successful...