EUVD-2026-79753

Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

CVE-2026-83453

CVE-2026-83453 affects Oracle Document Management and Collaboration (component: Internal Operations ) within Oracle E-Business Suite, versions 12.2.3 through 12.2.15 . The vulnerability is easily exploitable over HTTP by a high-privileged attacker, allowing full takeover of the product with high ...

CVE-2026-83454

A vulnerability in the Internal Operations component of Oracle Document Management and Collaboration (part of Oracle E-Business Suite) affects versions 12.2.3 through 12.2.15 . A low-privileged attacker with network access via HTTP can exploit this vulnerability with low complexity and no user in...

EUVD-2026-79751

Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

CVE-2026-83452

A critical vulnerability (CVSS 9.8) affects the Oracle Document Management and Collaboration component of Oracle E-Business Suite , specifically the Internal Operations component, in supported versions 12.2.3 through 12.2.15 . An unauthenticated attacker with network access via HTTP can exploit t...

CVE-2026-11864

IBM Cloud Pak for Business Automation versions 26.0.0 through 26.0.0 IF 001, 25.0.0 through 25.0.0 IF 005, 24.0.1 through 24.0.1 IF 008, and 24.0.0 through 24.0.0 IF 009 are affected by an XPath injection vulnerability. An authenticated attacker can use it to exfiltrate sensitive application data...

EUVD-2026-78901

IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to...

CVE-2026-81895

In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...

CVE-2026-81895 Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via `fsID[]` in `setMode=any`

In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...

CVE-2026-81895

Concrete CMS before 9.5.3 is affected by a stored, time-based blind SQL injection in the Document Library block . The block stored file-set identifiers submitted via fsID[] without validating them as integers. When configured with setMode=any, each stored identifier was concatenated directly into...

EUVD-2026-78837

In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...

CVE-2026-81895 Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via `fsID[]` in `setMode=any`

In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...

CVE-2026-81895 Concrete CMS 9.5.2 and below is vulnerable to Stored SQL Injection in Concrete CMS Document Library Block via `fsID[]` in `setMode=any`

In Concrete CMS before 9.5.3, the Document Library block stored the file-set identifiers submitted through fsID without validating them as integers, and when the block was configured with setMode set to any it concatenated each stored identifier directly into the file-set filter query instead of...

CVE-2026-91938 Flowise before 3.1.4 Server-Side Request Forgery via document loaders

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...

CVE-2026-91938

Flowise versions before 3.1.4 contain a server-side request forgery (SSRF) vulnerability in the Cheerio, Playwright, and Puppeteer document loader nodes. The flaw bypasses the built-in SSRF protection, allowing an attacker with low privileges to supply arbitrary URLs that cause the server to fetc...

EUVD-2026-78796

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...

CVE-2026-91938 Flowise before 3.1.4 Server-Side Request Forgery via document loaders

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...

RLSA-2026:67269 Important: perl-YAML-Syck security update

This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around. Security Fixes: YAML-Syck: YAML::Syck: Denial of Service via crafted YAML document CVE-2026-13713...

perl-YAML-Syck security update

An update is available for perl-YAML-Syck. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list This module provides a Perl interface to the libsyck data serializatio...

CVE-2026-83454: Improper Privilege Management

Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...