ECHO-C79D-4D79-8029

Bulletin has no description...

ECHO-DE58-3B9A-5F04

Bulletin has no description...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

ECHO-732C-D358-5FEF

Bulletin has no description...

ECHO-0BF7-79F8-3843

Bulletin has no description...

ECHO-746A-0A98-0B10

Bulletin has no description...

ECHO-3146-7A27-2D5A

Bulletin has no description...

PT-2026-64021

Name of the Vulnerable Software and Affected Versions Logto affected versions not specified Description Logto performs principal lookup without normalizing email and identifier strings. This lack of normalization allows for principal collision, which can lead to unauthorized account access when...

RHEL 8 : compat-openssl10 (RHSA-2026:44480)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:44480 advisory. The OpenSSL toolkit provides support for secure communications between machines. This version of OpenSSL package contains only the libraries and is...

PT-2026-64027

Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can...

PT-2026-64092

Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a...

PT-2026-64035

AgentGPT through 1.0.0 contains an authorization bypass through user-controlled key vulnerability that allows authenticated users to attach tasks to another user's agent run by supplying a target run id in the request body without ownership verification. The AgentCRUD.create task and validate tas...

CVE-2026-61246

CVE-2026-61246 affects Oracle Platform Security for Java (Oracle Fusion Middleware) - Centralized Thirdparty Jars. The vulnerability is exploitable over HTTP by a low-privileged attacker with network access and can lead to takeover of Oracle Platform Security for Java. Affected versions are 12.2....

CVE-2026-61246

...

CVE-2026-60439

...

CVE-2026-61246

...

CVE-2026-60372

CVE-2026-60372 concerns the Oracle Platform Security for Java component of Oracle Fusion Middleware, specifically the Centralized Thirdparty Jars. Affects supported versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows an unauthenticated attacker with network access over HTTP to compromise...

CVE-2026-60371

...

CVE-2026-60371

CVE-2026-60371 affects Oracle Platform Security for Java (Fusion Middleware), specifically the Centralized Thirdparty Jars component. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. The issue is described as difficult to exploit, requiring low privileges and access to the hardware’s physical com...