PT-2026-62400

Name of the Vulnerable Software and Affected Versions Oracle Data Integrator version 12.2.1.4.0 Oracle Data Integrator version 14.1.2.0.0 Description A flaw exists in the Patchset Assistant component of Oracle Fusion Middleware. A low privileged attacker with access to the infrastructure where th...

Amazon Linux 2 : perl-DBI, --advisory ALAS2-2026-3825 (ALAS-2026-3825)

The version of perl-DBI installed on the remote host is prior to 1.627-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3825 advisory. DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile. When a string is...

PT-2026-62051

Data::RingBuffer::Shared versions before 0.04 for Perl allow a stack buffer overflow via an unvalidated elem size in ring read seq. The attach-time validator ring validate header checks the capacity-overflow and total size consistency of the header but never caps elem size against the destination...

PT-2026-62615

Name of the Vulnerable Software and Affected Versions Oracle Partner Management versions 12.2.3 through 12.2.15 Description A flaw in the Partner Dashboard component allows a low privileged attacker with network access via HTTPS to compromise the system. This can lead to unauthorized read, update...

MiracleLinux 8 : kernel-4.18.0-553.141.2.el8_10 (AXSA:2026-1311:50)

"The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1311:50 advisory. kernel: tcp: fix potential race in tcpv6synrecvsock CVE-2026-43198 kernel: netfilter: nfnetlinkcthelper: fix OOB read in nfnlcthelperdumptable...

CVE-2026-15903

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-15903

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-15903

Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-47144 Shamefile has an arbitrary file read via shamefile.yaml in shame next

Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See...

CVE-2026-47144

Shamefile (a linter for undocumented linter warnings) has a path traversal vulnerability in the shame next command, exploitable via a crafted shamefile.yaml to disclose files outside the repository. Affected version before 0.1.7 is vulnerable; fix is available in 0.1.7 and later. Workarounds incl...

CVE-2026-47144 Shamefile has an arbitrary file read via shamefile.yaml in shame next

Shamefile is a linter for undocumented linter warnings. Prior to version 0.1.7, a path traversal vulnerability in shame next allows an attacker-controlled shamefile.yaml to disclose contents of files outside the repository, one line at a time, to the terminal of a user who runs the command. See...

glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

A flaw was found in GLib. A state confusion issue exists in gdbusnodeinfonewforxml in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a node element nested within other elements like method, signal, property or arg. This issue can cause an...

CVE-2026-44510

Removed by vendor...

CVE-2026-55544

NextCRM (open-source) vulnerability CVE-2026-55544 affects version 0.12.1, where MCP campaign tools expose read/write operations over the network via user-generated Bearer tokens (nxtc__...). Despite an authorization model restricting normal users to their own campaigns, multiple MCP handlers ign...

CVE-2026-55544

NextCRM is open-source customer relationship management CRM software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens nxtc.... The application has an authorization model that restricts normal users to...

CVE-2026-55544 NextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tampering

NextCRM is open-source customer relationship management CRM software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations over the network using user-generated Bearer API tokens nxtc.... The application has an authorization model that restricts normal users to...

CVE-2026-53594

Summary: CVE-2026-53594 affects FreeScout (PHP/Laravel) where the App Logs viewer can read arbitrary server files due to a flawed path resolution in the rap2hpoutre/laravel-log-viewer override. Before v1.8.224, the code accepts any existing absolute path prior to applying the storage/logs restric...

CVE-2026-53594 FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

CVE-2026-53594 FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's Manage - Logs - App Logs feature uses the bundled rap2hpoutre/laravel-log-viewer override to decrypt a user-supplied file identifier and then pass the resolved path to Laravel's download response. Prior...

USN-8573-1: libde265 vulnerabilities

It was discovered that libde265 did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause libde265 to crash, resulting in a denial of service. This issue only affected Ubuntu 22.04 LTS. CVE-2023-51792 It was discovered that libde265 did not...