PT-2026-93019

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Financial Management version 11.2.26.0.000 Description A security flaw in the Security component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to...

PT-2026-92135

Name of the Vulnerable Software and Affected Versions Confluence Data Center version 7.4.0 Confluence Data Center version 7.13.0 Confluence Data Center version 8.5.0 Confluence Data Center version 8.9.0 Confluence Data Center version 9.0.1 Confluence Data Center version 9.1.0 Confluence Data Cent...

ROS-20260915-73-0022

The vulnerability of the Site Isolation component in Google Chrome and Microsoft Edge is related to a lack of data security mechanisms. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

PT-2026-92183

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 10.1.0 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description Improper authorization checks on internal data emission endpoints could allow an authenticated user to...

CVE-2026-79994: Time-of-check Time-of-use (TOCTOU) Race Condition

The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later reconnects using the pathname. A malicious guest can replace an intermediate directory with a symlink between validation and connection, causing the host to...

CVE-2026-21587: Improper Authorization

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended access and can lead to the exposure of resource...

CVE-2026-21586: Improper Authorization

This High severity Improper Authorization vulnerability was introduced in versions 7.4.0, 7.13.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an...

CVE-2026-55375: Generation of Error Message Containing Sensitive Information

canto-saas-api is a PHP library for interacting with the Canto SaaS API. Prior to version 3.0.0, OAuth2Request::getQueryParams places appid, appsecret, refreshtoken, and code in the URL query string of token POST requests, allowing access logs, proxy logs, and APM traces to persist the credential...

CVE-2026-54689: Exposure of Sensitive Information to an Unauthorized Actor

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, the weburlread URL policy in src/url-reader.ts can be bypassed while MCPHTTPHARDEN is enabled and MCPHTTPALLOWPRIVATEURLS is not enabled because redirec...

CVE-2026-18232: Exposure of Sensitive Information to an Unauthorized Actor

The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through one of its public AJAX actions, allowing unauthenticated attackers to read draft and unapproved listings belonging to other users...

CVE-2026-15758: Exposure of Sensitive Information to an Unauthorized Actor

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data...

CVE-2026-69212: Exposure of Sensitive Information to an Unauthorized Actor

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers only when a redirect changes authority, but authority comparison excludes the URI scheme. A same-authority redirect from HTTPS to HTTP...

CVE-2026-55178: Exposure of Sensitive Information to an Unauthorized Actor

GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints authorize only the resource named in the request URL and fail to re-authorize a second caller-influenced dataset reached through a...

CVE-2026-76672: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability exists in the SD-WAN Orchestrator that may lead to the exposure of sensitive configuration information. An authenticated remote attacker with read-only privileges could exploit this vulnerability by sending a specially crafted request to the cache synchronization endpoint...

PT-2026-92172

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web url read receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed within src/url-reader.t...

CVE-2026-87221: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial...

PT-2026-92758

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Experience Manager. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

ROS-20260915-73-0028

The vulnerability of the SVG component in Google Chrome and Microsoft Edge relates to the disclosure of information. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data through a specially created HTML page...

PT-2026-92609

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM Siebel CRM Cloud Applications versions 22.3 through 26.7 Description An issue exists in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications. A low privileged attacker with access to the physical...

JFrog Artifactory < 7.111.20 / 7.117.x < 7.117.27 / 7.125.x < 7.125.19 / 7.133.x < 7.133.28 / 7.146.x < 7.146.35 Improper Authentication

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.111.20, 7.117.x prior to 7.117.27, 7.125.x prior to 7.125.19, 7.133.x prior to 7.133.28, or 7.146.x prior to 7.146.35. It is, therefore, affected by an improper authenticatio...