EulerOS Virtualization 2.12.0 : krb5 (EulerOS-SA-2026-2777)

According to the versions of the krb5 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In MIT Kerberos 5 aka krb5 before 1.22.3, there is a NULL pointer dereference if an application calls gssacceptseccontext on a system...

PT-2026-62617

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Workflow versions 12.2.3 through 12.2.15 Description A flaw in the Workflow Notification Mailer component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to...

PT-2026-62538

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware WebCenter Content: Imaging version 12.2.1.4.0 Oracle Fusion Middleware WebCenter Content: Imaging version 14.1.2.0.0 Description A flaw in the Core component allows a low privileged attacker with network access via HTT...

PT-2026-62223

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1 Oracle GraalVM for JDK versions 17.0.19 and 21.0.11 Oracle GraalVM Enterprise Edition version 21.3.18 Description An unauthenticated attacker with network...

PT-2026-63253

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 150.0.7871.182 Description A use-after-free issue exists in the GPU component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A...

PT-2026-62691

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description A flaw in the Web Content Management component of Oracle Fusion Middleware allows a low privileged attacker with network access via HTTP to...

CVE-2026-52474

An issue in aiflowy = 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file...

CVE-2026-15904

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2026-15904

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2026-51385

An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validateurl, safefetch, buildopener, fetchhtml and downloadbinary functions...

CVE-2026-13380

VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retriev...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries

A flaw was found in the crypto/x509 package of golang. This vulnerability allows a remote attacker to cause a Denial of Service DoS by presenting a specially crafted X.509 certificate with a large number of DNS Subject Alternative Name SAN entries. The certificate verification process, specifical...

golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...

ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation

A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized remote attacker to cause a Denial of Service DoS by allocating resources without proper limits or throttling. This can lead to the affected system becoming unresponsive or unavailable to legitimate users...

dotnet: .NET: Denial of Service due to uncontrolled resource allocation

A flaw was found in .NET where uncontrolled allocation of resources can lead to a Denial of Service DoS. An unauthorized remote attacker could exploit this vulnerability by continuously requesting resources without limits or throttling, causing the affected system to become unresponsive or crash...

dotnet: .NET Core: Denial of Service via type confusion

A flaw was found in .NET Core. This vulnerability, known as type confusion, allows an unauthorized remote attacker to cause a denial of service DoS over a network. By exploiting this flaw, an attacker can make the affected system unavailable to legitimate users...

CVE-2026-63834

A flaw was found in the Linux kernel's batman-adv throughput meter. A remote attacker could exploit an unbound list of unacknowledged packets by sending specially crafted messages. This could force the system to allocate excessive memory or waste significant CPU cycles, leading to a Denial of...

CVE-2026-55238

xrdp is an open source RDP server. Versions 0.10.6 and prior contain a vulnerability concerning the processing of RDP Confirm Active PDU, where during the capability negotiation phase, the parser did not perform sufficient length validation for specific capability sets. A remote, unauthenticated...