PT-2026-62124

The CONFIG USERSPACE syscall verifier z vrfy k poll in kernel/poll.c allocates a kernel-side copy of the user-supplied k poll event via z thread malloc and then validates each event's object handle. Before this fix, validation used K OOPSK SYSCALL OBJ... inline inside the loop, which kills the...

PT-2026-62612

Name of the Vulnerable Software and Affected Versions Oracle GoldenGate versions 23.4 through 23.26.1 Description A flaw in the Libraries component allows a low privileged attacker with access to the infrastructure where the software executes to compromise the system. Successful exploitation can...

PT-2026-63153

Name of the Vulnerable Software and Affected Versions Oracle Product Hub versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of Oracle Product Hub. A low privileged attacker with network access via HTTP can exploit this flaw to compromise the system,...

PT-2026-63010

Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS US. Successful...

PT-2026-63585

Name of the Vulnerable Software and Affected Versions fastjson versions 1.2.68 through 1.2.83 Description A remote code execution RCE issue exists in the fastjson library, specifically impacting Spring Boot applications. This flaw allows an unauthenticated attacker to execute arbitrary code with...

PT-2026-63136

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Workflow versions 12.2.3 through 12.2.15 Description A flaw in the Workflow Notification Mailer component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to...

PT-2026-62719

Vulnerability in the Oracle U.S. Federal Financials product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle U.S...

PT-2026-62971

Vulnerability in the Oracle Performance Management product of Oracle E-Business Suite component: Appraisals. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Performance...

PT-2026-61933

Name of the Vulnerable Software and Affected Versions FlexCity versions 5.536.0 through 5.541.0 Description An open redirect issue allows input data manipulation by redirecting users to untrusted sites. Recommendations Update FlexCity to version 5.542.0...

PT-2026-62779

Name of the Vulnerable Software and Affected Versions Oracle iReceivables versions 12.2.3 through 12.2.15 Description An issue exists in the AR Web Utilities component of the Oracle iReceivables product within Oracle E-Business Suite. An unauthenticated attacker with network access via HTTP can...

@a-rt-works/auth0-deploy-cli (3.3.3), @acknow-srl/express-openid (>=1.0.0, <=1.0.1) +540 more potentially affected by CVE-2026-67320 via axios (>=0.31.1, <=0.32.0)

axios NPM version =0.31.1, =1.0.0, =0.0.1, =0.0.2, =1.3.2, =0.2.0, =0.0.2-beta.0, =2.0.14, =0.5.12, =1.0.0, =1.0.1, =32.0.0, =0.2.4, =0.3.0 and more Source cves: CVE-2026-67320 Source advisory: OSV:GHSA-GCFJ-64VW-6MP9...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +14447 more potentially affected by CVE-2026-67317 via axios (>=1.7.0, <=1.17.0)

axios NPM version =1.7.0, =0.0.8, =0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, =1.0.53, =0.1.0, =1.0.0, =0.1.0, =0.1.2, =1.1.0, =0.1.0, =1.0.21, =0.1.4, =0.1.0, =0.1.2 and more Source cves: CVE-2026-67317 Source advisory: OSV:GHSA-JQH4-M9W3-8HP9...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +14447 more potentially affected by CVE-2026-67317 via axios (>=1.7.0, <=1.17.0)

axios NPM version =1.7.0, =0.0.8, =0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, =1.0.53, =0.1.0, =1.0.0, =0.1.0, =0.1.2, =1.1.0, =0.1.0, =1.0.21, =0.1.4, =0.1.0, =0.1.2 and more Source cves: CVE-2026-67317 Source advisory: SNYK:JS-AXIOS-18065353...

0xtrails (>=0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, <=0.17.1), 123pancli (1.0.0) +6612 more potentially affected by CVE-2026-67315 via axios (>=1.15.0, <=1.17.0)

axios NPM version =1.15.0, =0.0.0-canary-3a59770274bcb6f3bebd5d1b93a2c92d1fc4edbd, =0.1.0, =1.1.0, =0.1.0, =1.0.21, =0.1.4, =0.1.0, =1.0.10, =1.0.10, =0.6.6, =0.6.10, =0.6.9, =0.6.15 - @0xdeepak/wallets 0.0.2 and more Source cves: CVE-2026-67315 Source advisory: SNYK:JS-AXIOS-18065357...

NPM: protobufjs: Text Format string map parsing can mutate returned map object prototype

NPM: protobufjs: Text Format string map parsing can mutate returned map object prototype vulnerability discovered by ? in WordPress Npm protobufjs versions = 8.2.0, = 8.6.4...

NPM: protobufjs: Denial of Service via infinite loop in .proto option parsing

NPM: protobufjs: Denial of Service via infinite loop in .proto option parsing vulnerability discovered by ? in WordPress Npm protobufjs versions = 7.5.0, = 7.6.4...

@4399ywkf/core (>=5.0.0, <=5.0.32), @all-star/base (>=0.17.0, <=0.18.2) +326 more potentially affected by CVE-2026-14631 via webpack-dev-server (>=5.0.0, <=5.2.5)

webpack-dev-server NPM version =5.0.0, =5.0.0, =0.17.0, =0.17.0, =0.17.0, =8.0.0-next.2, =20.3.1, =20.3.0, =18.0.0-beta.3, =18.0.0-beta.3, =18.2.6-RC-1, =18.0.0, =18.0.0-next.0, =0.7.7, =1.0.5-beta.4, =1.0.1-beta.1, =1.0.17 and more Source cves: CVE-2026-14631 Source advisory:...

NPM: js-yaml: YAML merge-key chains can force quadratic CPU consumption

NPM: js-yaml: YAML merge-key chains can force quadratic CPU consumption vulnerability discovered by ? in WordPress Npm js-yaml versions = 3.0.0, 3.15.0...

Helm: Helm: Denial of Service via malformed chart files

A flaw was found in Helm. A remote attacker can exploit a denial of service vulnerability by including zero-length byte slices, such as empty files, within Helm chart files. This can trigger an index out of range panic in the Files.Lines template helper, leading to deterministic render failures...

Helm: Helm: Denial of Service via malformed chart files

A flaw was found in Helm. A remote attacker can exploit a denial of service vulnerability by including zero-length byte slices, such as empty files, within Helm chart files. This can trigger an index out of range panic in the Files.Lines template helper, leading to deterministic render failures...