CVE-2026-101577

A vulnerability exists in the helidon-cors component of the Oracle Fusion Middleware Helidon product, affecting supported versions 4.0.0-4.5.5 . This high-complexity vulnerability allows an unauthenticated attacker with HTTP network access to compromise Helidon, provided that human interaction fr...

CVE-2026-101573

The Helidon product of Oracle Fusion Middleware is affected by a vulnerability in the helidon-security-providers-http-auth component. Affected versions include 3.0.0-3.2.21 , 4.0.0-4.5.5 , and 27.0.0 . An unauthenticated attacker with network access via HTTP can exploit this difficult to exploit ...

CVE-2026-101574

A vulnerability exists in the OIDC component of the Helidon product within Oracle Fusion Middleware (affected versions 4.0.0-4.5.5 and 27.0.0 ). An unauthenticated attacker with network access via HTTP can exploit this high-complexity vulnerability, which requires human interaction , to compromis...

CVE-2026-101575

A vulnerability exists in the Helidon product of Oracle Fusion Middleware (component: LRA ) affecting versions 4.0.0-4.5.5 . This difficult-to-exploit vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Helidon, which may significantly impact additional pro...

CVE-2026-101571

A vulnerability exists in the helidon-security-providers-idcs-mapper component of the Helidon product within Oracle Fusion Middleware . Affected versions include 3.0.0-3.2.21 and 4.0.0-4.5.5 . A low-privileged attacker with local infrastructure access can exploit this difficult-to-execute vulnera...

CVE-2026-101569

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-common-concurrency-limits. Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon...

CVE-2026-101569

A vulnerability exists in the helidon-common-concurrency-limits component of the Helidon product within Oracle Fusion Middleware . Affected versions include 4.0.0-4.5.5 and 27.0.0 . An unauthenticated attacker with network access via HTTP can easily exploit this flaw to gain unauthorized update, ...

CVE-2026-101568

A vulnerability exists in the helidon-health component of the Oracle Fusion Middleware Helidon product. Affected versions include 3.0.0-3.2.21 , 4.0.0-4.5.5 , and 27.0.0 . An unauthenticated attacker with network access via HTTP can exploit this flaw to gain unauthorized read access to a subset o...

CVE-2026-101499

A vulnerability exists in the Oracle WebCenter Sites component of Oracle Fusion Middleware . The affected versions are 12.2.1.4.0 and 14.1.2.0.0 . An unauthenticated attacker with network access via HTTP can easily exploit this vulnerability to compromise the product, which may result in a comple...

CVE-2026-112712

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...

CVE-2026-112712 @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...

EUVD-2026-105361

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...

CVE-2026-112712

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...

CVE-2026-112712

The @fastify/middie middleware engine for Fastify (versions 9.0.0 through 9.3.5 ) is vulnerable to a path-scoped middleware bypass . The use() function incorrectly joins mount paths with plugin scope prefixes, specifically when the prefix ends in a slash, contains array mount paths, or lacks a le...

CVE-2026-112712 @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch

@fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix...

CVE-2026-112942

A flaw was found in launch-editor. This vulnerability can allow a remote attacker to achieve arbitrary command execution on Windows systems. By submitting a specially crafted file path containing line and column suffixes, an attacker can bypass file existence checks due to improper path validatio...

CVE-2026-112945

A flaw was found in Vite. An attacker can achieve arbitrary script execution in a user's browser by convincing a victim to load a crafted development server page when an application uses custom middleware. Due to improper handling of leading slashes in request URLs during HTML transformation, the...

org.webjars.npm:launch-editor-middleware (2.2.1) potentially affected by CVE-2026-112944 via org.webjars.npm:launch-editor (2.14.1)

org.webjars.npm:launch-editor MAVEN version 2.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:launch-editor and may be impacted: - org.webjars.npm:launch-editor-middleware 2.2.1 Source cves: CVE-2026-112944 Source advisory:...

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

Summary launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution. Impact Direct launch-editor users Only apps that match all of t...

Arbitrary Argument Injection

Overview vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Arbitrary Argument Injection via the getArgumentsForFile function in packages/launch-editor/get-args.js, where a filename is passed directly to an editor process without being resolved to ...