PT-2026-49983

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Base Platform version 13.5 Oracle Enterprise Manager Base Platform version 24.1 Description An issue exists in the Deployment Library component of the Oracle Enterprise Manager Base Platform. A high privileged attacke...

PT-2026-49849

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft PeopleSoft Enterprise PT PeopleTools versions 8.61 through 8.62 Description A flaw in the Deployment Package component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful...

PT-2026-49861

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft PeopleSoft Enterprise PT PeopleTools versions 8.61 through 8.62 Description An issue exists in the Deployment Package component of PeopleSoft Enterprise PT PeopleTools. A high-privileged attacker with access to the...

MAL-2026-5819 Malicious code in mozautomation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 26d0e7dfb965969f23786d4bde7d70e597b83df522434aea471171d48442cd12 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

What Changed in OWASP Top 10 2025 and Recommendations for Each Category

Key Takeaways 1. The 2025 list introduces two new categories – Software Supply Chain Failures A03 and Mishandling of Exceptional Conditions A10 - reflecting attacks already happening in production. 2. Security Misconfiguration jumping from 5 to 2 signals that continuous deployment without...

CVE-2026-50633

A flaw was found in Apache CXF's JCA integration module. This Java Naming and Directory Interface JNDI Injection vulnerability allows for arbitrary code execution. A remote attacker could exploit this by manipulating the Java EE Connector Architecture JCA deployment descriptor ra.xml or runtime...

VulnPilot

VulnPilot VulnPilot is an automation framework for vulnerabil...

Exploit for CVE-2026-41490

CVE-2026-41490 — SQL Injection in Dagster database I/O manager...

Radius Controller May Delete a Container Resource via an Injected Deployment Annotation (Multi-Tenant Installs)

Radius Controller May Delete a Container Resource via an Injected Deployment Annotation Multi-Tenant Installs Summary A configuration-validation issue in the Radius Kubernetes controller can cause it to issue a DELETE for the container resource referenced by a tampered radapp.io/status annotation...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' in the deserialization process of user-controlled data from the radapp.io/status annotation on a Kubernetes Deployment. An attacker can cause deletion of container resources belonging t...

GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page

Summary A vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to t...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.2 <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1 <=0.1.0-alpha.4) +29726 more potentially affected by CVE-2026-50010 via io.netty:netty-handler (>=4.0.0.Alpha1 <=4.1.134.Final)

io.netty:netty-handler MAVEN version =4.0.0.Alpha1, =0.1.0-alpha.2, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.3, =0.1.0-alpha.2, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.28.0 and more Source cves:...

no.ks.fiks:adresseregisteret-client (>=1.5.0 <=1.6.0), no.ks.fiks:fastlegeregisteret-client (>=1.5.0 <=1.6.0) +14 more potentially affected by CVE-2026-50634 via org.apache.cxf:cxf-rt-rs-security-jose-jaxrs (>=4.2.0 <=4.2.1)

org.apache.cxf:cxf-rt-rs-security-jose-jaxrs MAVEN version =4.2.0, =1.5.0, =1.5.0, =1.5.0, =4.19.0, =3.35.0, =3.35.0, =3.35.0, =4.19.0, =4.19.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.1 and more Source cves: CVE-2026-50634 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339189...

no.ks.fiks:adresseregisteret-client (>=1.0.0 <=1.4.0), no.ks.fiks:fastlegeregisteret-client (>=1.0.0 <=1.4.0) +15 more potentially affected by CVE-2026-50631 via org.apache.cxf:cxf-rt-rs-security-oauth2 (>=4.0.0 <=4.1.6)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version =4.0.0, =1.0.0, =1.0.0, =1.0.0, =4.7.0, =4.0.0, =3.0.0-M1, =3.0.0-M1, =3.0.0-M1, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.0.0, =4.1.6 and more Source cves: CVE-2026-50631 Source advisory: SNYK:JAVA-ORGAPACHECXF-17339183...

CVE-2026-50633 Apache CXF: JNDI Injection vulnerability in DispatchMDBMessageListenerImpl

A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor ra.xml or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or...

SUSE CVE-2026-48681

OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image...

PT-2026-48971

MISP contains an insecure default configuration in which the Security.check sec fetch site header control is disabled. When this setting is disabled, state-changing requests such as POST, PUT, or AJAX requests are not restricted based on the browser-provided Sec-Fetch-Site header. A remote...

PT-2026-49062

Name of the Vulnerable Software and Affected Versions Radius versions 0.57.1 and earlier Description A configuration-validation issue in the Radius Kubernetes controller allows for a Confused Deputy attack. The controller deserializes JSON data from the radapp.io/status annotation on Kubernetes...

CVE-2026-47172

Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.3, the repository has a privileged deploy workflow that runs after the unprivileged build workflow completes. The build workflow runs on pull requests, and the deploy workflow checks ou...

UBUNTU-CVE-2026-11774

An integer overflow flaw was found in the SASL I/O layer of 389 Directory Server 389-ds-base. In sasliostartpacket, adding sizeofuint32t to a crafted SASL packet length prefix of 0xFFFFFFFC causes unsigned wraparound to zero, bypassing the nsslapd-maxsasliosize limit and leading to a heap buffer...