PT-2026-118261

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

PT-2026-118262

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

Linux kernel DoS

The vulnerability in the drivers/rtc/rtc-msc313.c component of the Linux kernel is related to dereferencing pointers. Exploitation of this vulnerability may allow an attacker to cause a denial of service...

PT-2026-118260

BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents...

CVE-2026-19197

A flaw was found in Grafana. This broken access control vulnerability allows a user with organization administrator permissions to delete dashboard snapshots belonging to other organizations on the same Grafana instance. Furthermore, the flaw enables the recovery of a snapshot's secret delete key...

CVE-2025-6623 Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection

The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actio...

CVE-2025-6623 Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection

The carbon console accepts user-supplied XML input without sufficiently encoding potentially executable content, allowing for the injection of malicious scripts. Successful exploitation allows a remote attacker to execute arbitrary JavaScript in the context of a victim's browser, leading to actio...

CVE-2025-6623

The carbon console in multiple WSO2 products is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the acceptance of user-supplied XML input without sufficient encoding of potentially executable content. A remote attacker can inject malicious scripts to execute arbitrary JavaScri...

Oracle Java SE security vulnerabilities

Oracle Java SE 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27 versions; Oracle GraalVM for JDK 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition 21.3.19.1.1 have security vulnerabilities. These vulnerabilities stem from issues with the JAXP component and are difficu...

WordPress WP User Manager Authorization Vulnerability

WordPress WP User Manager 2.9.25 and earlier versions have a vulnerability related to authorization. This vulnerability arises from a lack of authorization checks, which may lead to manipulation of user status...

Oracle Siebel Apps – Marketing security vulnerabilities

Oracle Siebel Apps – Versions 17.0 to 26.9 have security vulnerabilities. These vulnerabilities stem from issues with the Marketing component. They may allow unauthorized attackers to access through an HTTPS network, to make unauthorized updates, insert or delete certain accessible data, and to...

Oracle Helidon security vulnerabilities

Oracle Helidon versions 3.0.0 to 3.2.21 have security vulnerabilities. These vulnerabilities stem from issues with the helidon-grpc-server component. Unauthorized attackers may gain access through HTTP/2 networks, allowing them to perform unauthorized updates, insert or delete certain accessible...

Oracle SOA Suite security vulnerabilities

Oracle SOA Suite versions 12.2.1.4.0 and 14.1.2.0.0 have security vulnerabilities. These vulnerabilities stem from issues with the Fabric Layer component. Vulnerable attackers may gain access through an HTTPS network. Unauthorized updates, insertions, or deletions of certain accessible data are...

Oracle Siebel Apps – Vulnerabilities in Marketing Permission Settings and Access Control Mechanisms

Oracle Siebel Apps – Versions 17.0 to 26.9 have vulnerabilities related to permission licensing and access control. These vulnerabilities stem from issues with the Marketing component, allowing unauthorized attackers to access through the HTTP network. This enables them to update, insert, or dele...

Oracle Java SE security vulnerabilities

Security vulnerabilities exist in Oracle Java SE versions 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, and 27; in Oracle GraalVM for JDK versions 17.0.20.1 and 21.0.12.1; and in Oracle GraalVM Enterprise Edition version 21.3.19.1.1. These vulnerabilities stem from issues with the...

Oracle Java SE security vulnerabilities

A security vulnerability exists in Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition versions 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, version 27, and version 21.3.19.1.1. This vulnerability stems from an issue in the Serviceability component...

Oracle Siebel CRM Deployment security vulnerability

A security vulnerability exists in Oracle Siebel CRM Deployment versions 17.0 through 26.9. This vulnerability stems from issues within the Server Infrastructure component, potentially allowing unauthenticated attackers to gain HTTP access. They may then make unauthorized updates, insert, or dele...

Improper Neutralization

Overview Affected versions of this package are vulnerable to Improper Neutralization via convertMetadataToHeaders in the Camel Tika producer. An attacker can manipulate downstream route behavior, including where a later file producer writes content, by supplying a document with metadata such as...

CVE-2026-112287

Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restricted authenticated users to manipulate other users' emails by supplying their numeric IDs. Attackers can call update, destroy, mass-update or mass-destroy...

CVE-2026-112147 ai-genius-automations octoally index.ts information disclosure

A vulnerability was found in ai-genius-automations octoally up to 1.0.87. The impacted element is an unknown function of the file server/src/index.ts. Performing a manipulation of the argument path results in information disclosure. The attack may be initiated remotely. The exploit has been made...