BIT-ELASTICSEARCH-2026-72687 Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service

A flaw in Elasticsearch allows a low-privileged authenticated user to submit a single small request containing a forged opaque identifier. Elasticsearch decodes and deserializes the identifier before confirming that it was legitimately issued by the cluster, and a size value carried inside the...

CVE-2026-70980

creationtimestamp| type| source ---|---|--- 2026-08-19 07:40:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtga3iytc32e 2026-08-19 16:47:54+00:00| seen| https://www.acn.gov.it/portale/w/critical-patch-update-di-oracle-10 2026-08-26 00:37:07+00:00| seen|...

CGA-5796-686X-6CX2

Bulletin has no description...

CVE-2026-61206

creationtimestamp| type| source ---|---|--- 2026-08-18 22:13:42+00:00| seen| https://bsky.app/profile/stemshop.bsky.social/post/3mtfagrju6l24 2026-08-19 02:20:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mtfo7bm2of2b 2026-08-19 17:49:26+00:00| seen|...

CVE-2026-71061

Affected component is the BI Platform Security of Oracle Business Intelligence Enterprise Edition, impacting versions 8.2.0.0.0 and 26.01.0.0.0. An unauthenticated attacker with network access via HTTP can compromise confidentiality, potentially accessing all BIE accessible data. CVSS 3.1 base sc...

CVE-2026-70939

...

CVE-2026-70735

...

CVE-2026-70712

CVE-2026-70712 affects the Install component of Oracle Agile Engineering Data Management (Oracle Supply Chain), version 6.2.1 . The vulnerability allows a high-privileged local attacker to achieve full compromise of the product, resulting in complete loss of confidentiality, integrity, and availa...

CVE-2026-62634

...

CVE-2026-62581

...

CVE-2026-62553

...

CVE-2026-62481

Oracle Hyperion Infrastructure Technology 11.2.25.0.000 is affected in the Common Events component. A low-privileged attacker with network SQL access can achieve full product takeover (C/I/A impact). Oracle's August 2026 CPU advisory (cspuaug2026.html) provides remediation; no exploit details are...

CVE-2026-61284

...

CVE-2026-60909

...

CVE-2026-60865

Oracle Fusion Middleware's Service Delivery Platform Messaging Enabler component (versions 14.1.2.0.0 and 12.2.1.4.0) is vulnerable to network-based HTTP attacks by high-privileged attackers, allowing unauthorized access to critical data with scope-change impact across additional products. CVSS 3...

BELL-CVE-2026-14670

Bulletin has no description...

MINI-2H8C-QGMR-7HCC

Bulletin has no description...

MINI-CX6M-C229-GP9X

Bulletin has no description...

CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...

CVE-2026-18674 Kong Mesh multi-zone: the global control plane attributes KDS-synced resources by an unvalidated in-band zone identifier

On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store...