PT-2026-78141

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon version 3.2.18 Description A flaw in the Imperative Web Server component allows a low privileged attacker with network access via HTTP to compromise the system. This issue can lead to unauthorized access to...

PT-2026-78125

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.14 Description A flaw in the Core component allows a high privileged attacker with access to the infrastructure where the software executes to compromise the system. This can lead to an unauthorized hang or a...

PT-2026-78086

Name of the Vulnerable Software and Affected Versions Oracle Business Intelligence Enterprise Edition version 26.01.0.0.0 Description An issue exists in the Analytics Web Answers component of Oracle Business Intelligence Enterprise Edition. A high privileged attacker with network access via HTTP...

PT-2026-77725

Vulnerability in the Oracle Cash Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Cash Management...

PT-2026-77425

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 14.1.2.0.0 Description A flaw in the Content Server component of Oracle Fusion Middleware allows a low-privileged attacker with access to the execution infrastructure to compromise the system. This issue can le...

PT-2026-77602

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 Description An issue exists in the Installation and Configuration component of Oracle Hyperion Infrastructure Technology. A low-privileged attacker with access to the infrastructu...

PT-2026-78106

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Financial Management version 11.2.25.0.000 Description A security flaw in the Security component allows a high privileged attacker with access to the infrastructure where the software executes to compromise the system. Successf...

CVE-2026-72642

The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with th...

CVE-2026-48384

ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker with high privileges could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not...

CVE-2026-44758

CVE-2026-44758 affects SAP Manufacturing Integration and Intelligence (MII). The description states that an attacker with high privileges can submit specially crafted input processed without sufficient validation, potentially allowing execution of arbitrary commands on the underlying OS with high...

CVE-2026-20488

In display, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11004276; Issue ID: MSV-7757...

CVE-2026-20475

In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11004276; Issue ID: MSV-7748...

CVE-2026-20467

In apusys, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: AUTO00837766; Issue ID: MSV-6767...

PT-2026-67162

Name of the Vulnerable Software and Affected Versions display affected versions not specified Description A race condition in display allows for a local escalation of privilege. This occurs when a malicious actor who has already obtained System privilege exploits the timing of events to gain...

DEBIAN-CVE-2026-50735

pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogic...

CVE-2026-64178

A flaw was found in the Linux kernel's Bluetooth Network Encapsulation Protocol BNEP module. A local attacker with administrative network capabilities CAPNETADMIN could exploit a use-after-free vulnerability in the bnepaddconnection function. This occurs because the function fails to properly...

CVE-2026-34030 Improper branch-code validation in Wertheim SafeController Software allows file path manipulation

The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, does not sufficiently validate the branch code when a new branch is created. The branch code is later used in multiple application functions, including filesystem path generation for uploaded files, profile pictures, and...

CVE-2026-7184 Mattermost Remote Cluster PATCH API Leaks Authentication Tokens

Mattermost versions 11.6.x = 11.6.1, 11.5.x = 11.5.4, 10.11.x = 10.11.15 fail to sanitize the Remote Cluster API response on PATCH operations, which allows authenticated users with the managesecureconnections permission to obtain remote cluster authentication tokens via a PATCH request to the...

CVE-2026-11884

A heap buffer overflow flaw was found in 389 Directory Server. When serializing objectclass definitions, the ocsuperior SUP field length is omitted from buffer size calculations in readschemadse and schemaoctostring, but the field is still written via strcat. An attacker with Directory Manager...

CVE-2026-11884 389-ds-base: 389-ds-base: heap buffer overflow in schema objectclass serialization due to missing oc_superior in size calculation

A heap buffer overflow flaw was found in 389 Directory Server. When serializing objectclass definitions, the ocsuperior SUP field length is omitted from buffer size calculations in readschemadse and schemaoctostring, but the field is still written via strcat. An attacker with Directory Manager...