Red Hat: CVE-2026-87863: curl: curl: Hsts Response Erases Persisted Entries

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

CVE-2025-60494

A segmentation violation in the gfpropsequalinternal function /filtercore/filterprops.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted data file...

Atlassian Jira Service Management Data Center and Server 10.0.x < 10.3.26 / 10.4.x < 11.3.12 (JSDSERVER-16833)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16833 advisory. - nanoid Nano ID before 5.1.6 contains an infinite loop in the customAlphabet and customRandom...

AlmaLinux 9.6 [TuxCare] Security Update: python3.11 / python3.11-debug / python3.11-devel / python3.11-idle / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1792411096)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1792411096 advisory. - The webbrowser.open API would accept leading dashes in the URL which could be handled as command line options for certain web...

Siemens Desigo PXC/PXM Controllers Out-of-bounds Read (CVE-2026-89208)

The affected product does not properly validate input bounds before accessing packet data. This could allow an unauthenticated remote attacker to trigger memory reads outside the intended packet boundaries. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46275)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciuart: fix UAFs and race conditions in close and init paths Vulnerabilities leading to Use-After-Free UAF and Null Pointer Dereference NPD conditions were observed in the lifecycle management of hciuart. The primary...

Atlassian Jira Service Management Data Center and Server < 10.3.25 / 10.4.x < 11.3.11 (JSDSERVER-16791)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16791 advisory. - Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being...

Atlassian Jira Service Management Data Center and Server 5.9.x < 10.3.25 / 10.4.x < 11.3.11 (JSDSERVER-16789)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16789 advisory. - Netty io.netty:netty-handler versions from 4.2.0.Final through 4.2.16.Final and versions through...

Atlassian Jira Service Management Data Center and Server 10.3.x < 10.3.26 / 11.3.x < 11.3.11 (JSDSERVER-16835)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16835 advisory. - The CBOR parser in FasterXML jackson-dataformats-binary never invokes...

Atlassian Jira Service Management Data Center and Server < 10.3.24 / 11.3.x < 11.3.8 (JSDSERVER-16824)

The version of Atlassian Jira Service Management Data Center and Server Jira Service Desk running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16824 advisory. - Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2025-38250)

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix use-after-free in vhciflush syzbot reported use-after-free in vhciflush without repro. 0 From the splat, a thread closed a vhci file descriptor while its device was being used by iotcl on another thread...

PT-2026-119070

Vulnerability in Oracle REST Data Services component: Core. Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can...

Oracle E-Business Suite: CVE-2026-101837: Critical Patch Update

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite component: Workflow Events. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Shipping...

PT-2026-120019

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Updates Environment Mgmt. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

Oracle E-Business Suite: CVE-2026-83366: Critical Patch Update

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite component: Workflow Events. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping...

PT-2026-119993

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: QAS. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools...

Oracle E-Business Suite: CVE-2026-87295: Critical Patch Update

Vulnerability in the Oracle HRMS India product of Oracle E-Business Suite component: Indian Payroll. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS India executes to...

PT-2026-119069

Vulnerability in Oracle REST Data Services component: ADP. Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can...

PT-2026-119073

Vulnerability in Oracle REST Data Services component: Core. Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can...

PT-2026-119506

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite component: Workflow Events. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping...