61276 matches found
CVE-2026-60414: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Core. The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology...
CVE-2026-60392: Deserialization of Untrusted Data
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In PDF Export SDK. The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In...
CVE-2026-60413: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Core. The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology...
Linux Distros Unpatched Vulnerability : CVE-2026-72180
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: preserve pmdswpuffdwp on device-private PMD downgrade changenonpresenthugepmd...
PT-2026-77550
Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Work in Process versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. Successful...
PT-2026-77546
Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Work in Process versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to a...
PT-2026-80227
Vulnerability Summary com.rabbitmq.client.TrustEverythingTrustManager accepts ANY TLS certificate including null chains and is used as the default trust manager when calling ConnectionFactory.useSslProtocol without arguments. Combined with hostname verification being disabled by default, this...
PT-2026-77021
Name of the Vulnerable Software and Affected Versions Firefox versions 153 through 153 Firefox ESR version 153.0 Thunderbird versions 153 through 153 Thunderbird ESR version 153.0 Description Internal bugs were identified that exhibit evidence of memory corruption or other security-relevant...
PT-2026-77314
Name of the Vulnerable Software and Affected Versions Blueprint Studio versions prior to 2.5.2 Description Blueprint Studio improperly configures the Git credential.helper store when saving credentials. This causes the system to persist usernames and access tokens in plaintext within the...
Linux Distros Unpatched Vulnerability : CVE-2026-74364
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf: Reject exclusive maps as inner maps in map-in-map An exclusive map created with...
AlmaLinux 9 : curl (ALSA-2026:55439)
The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:55439 advisory. curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-1965 curl: curl: Information disclosure via...
CVE-2026-72130
A flaw was found in the nvmet-auth component of the Linux kernel. A remote attacker, by sending a specially crafted AUTHRECEIVE buffer to an NVMe-oF NVM Express over Fabrics target with in-band authentication enabled, can trigger a heap out-of-bounds write. This vulnerability arises because the...
atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)
The HTTP MCP server-registry backend factory atomicagents/mcpregistry/http.py, makehttpmcpserverregistrybackendfromurl accepts both http and https schemes. Catalog entries carry command/args that are type-validated but content-unrestricted, and are later spawned as local stdio subprocesses by...
Resources Downloaded over Insecure Protocol
Overview atomic-agents-stack is a Spec + reference implementation for vault-native, multi-runtime AI agents Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol via the makehttpmcpserverregistrybackendfromurl process. An attacker can execute arbitrary...
GHSA-XHCR-CQFR-M3HV atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)
The HTTP MCP server-registry backend factory atomicagents/mcpregistry/http.py, makehttpmcpserverregistrybackendfromurl accepts both http and https schemes. Catalog entries carry command/args that are type-validated but content-unrestricted, and are later spawned as local stdio subprocesses by...
DEBIAN-CVE-2026-34398
FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, src/Mod/BIM/bimcommands/BimProjectManager.py in the BIM Project Manager Load Template flow passes attacker-controlled FCStd Meta property values for wpposition, wpu, wpv, and wpaxis directly to eval,...
CVE-2026-74234
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
EUVD-2026-60373
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++...
EUVD-2026-60372
Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp copies a Notepad++ variable name between $ and into the fixed-size wchart strMAXPATH stack buffer without bounding the m loop...
