EUVD-2026-80831

Pocketbase: Unhandled panic in worker goroutines...

Malicious code in leda-middleware-pm2-impulse (npm)

The package leda-middleware-pm2-impulse was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in lacerta-middleware-procyon-exec (npm)

Source: amazon-inspector da1b28da3265a24a7bcce4680ed10ee0d5aa21f933a37897e5c22f5b5203a960 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in karma-middleware (npm)

The package karma-middleware was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in juno-middleware-wolf-webdriverio (npm)

Source: amazon-inspector 0ab43699bf0436caf664910e6f461b70bd8b0741fb747d0d7ef3619ee3509c79 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in juno-sync-middleware-ini (npm)

Source: amazon-inspector e5262c9aa5283b0187448f086b75b73d09c9b6329b9468931b0f2d7e353f198f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

GO-2026-6465 Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging in github.com/traefik/traefik

Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing, middleware guards and access logging in github.com/traefik/traefik...

CVE-2026-82410 Pocketbase: Unhandled panic in worker goroutines

Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server proces...

CVE-2026-82410

Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server proces...

Vulnerabilities in Oracle Fusion Middleware

Oracle has identified 153 vulnerabilities in various Oracle Fusion Middleware products, including Helidon, Oracle Access Manager, Oracle Coherence, Oracle Data Integrator, Oracle Forms, Oracle Fusion Middleware Control, Oracle Identity Manager, Oracle Identity Manager Connector, Oracle Internet...

Oracle Coherence 15.1.1.0.x < 15.1.1.0.5 Multiple Vulnerabilities (September 2026 CSPU)

The 15.1.1.0.0 version of Coherence installed on the remote host is affected by multiple vulnerabilities as referenced in the September 2026 CSPU advisory. - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. The supported version that is affected is...

WebLogic Server Proxy Plug-In Unauthorized Access

The vulnerability of the WebLogic Server Proxy Plug-In for third-party web servers within the Oracle Fusion Middleware software platform is related to access control errors. Exploiting this vulnerability could allow an attacker to gain unauthorized access to create, delete, or modify data using t...

WebLogic Server Proxy Plug-In Unauthorized Access

The vulnerability of the WebLogic Server Proxy Plug-In for third-party web servers within the Oracle Fusion Middleware software platform is related to the absence of authentication for a critical function. Exploiting this vulnerability could allow an intruder to gain unauthorized access to create...

Oracle Unified Directory OUD Core Full Control

The vulnerability of the OUD Core component of the Oracle Unified Directory application, a simplified deployment solution for the Oracle Fusion Middleware software platform, is related to the absence of authentication for a critical function. Exploiting this vulnerability could allow an attacker ...

Messaging Enabler Component Full Control

The vulnerability of the Messaging Enabler component of the Service Delivery Platform software, part of the Oracle Fusion Middleware software platform, is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to...

Messaging Enabler Component Full Control

The vulnerability of the Messaging Enabler component of the Service Delivery Platform software, part of the Oracle Fusion Middleware software platform, is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to...

CVE-2026-82410: Uncaught Exception

Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server proces...

PT-2026-93817

Name of the Vulnerable Software and Affected Versions Pocketbase versions prior to 0.22.48 Pocketbase versions prior to 0.39.7 Description The panic-recovery middleware handles regular requests but does not cover internal child and worker goroutines. A panic within these internal goroutines can...

Oracle Coherence CVE-2026-83411 (September 2026 CSPU)

The 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 versions of Coherence installed on the remote host are affected by a vulnerability as referenced in the September 2026 CSPU advisory. - Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in http-proxy-middleware

Summary IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in http-proxy-middleware Vulnerability Details CVEID:CVE-2026-55602 DESCRIPTION: http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents...