ViewSonic vCast authorization issue vulnerability

ViewSonic vCast v3.2.715 and earlier versions contain an authorization issue vulnerability. This vulnerability arises because the screen capture endpoint lacks authentication. Unauthenticated remote attackers can use GET requests to access the /snapshot or /screen endpoints, thereby obtaining JPE...

CVE-2026-97400 jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host...

CVE-2026-97400 jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host...

CVE-2026-97400

In Eclipse OpenJ9 versions up to 0.63 , the jdmpview tool (or equivalent DTFJ code) is vulnerable to an XML External Entity (XXE) injection within the XMLIndexReader component. An attacker can cause the analyst's machine to read arbitrary local files specified within a supplied diagnostic dump bu...

CVE-2026-97400 jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host...

Exploit for CVE-2017-0143

CVE-2017-0143 — Microsoft Windows SMBv1 Remote Code Execution...

CVE-2026-75753

Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a specific mode. As a result, when the router encounters abnormal...

CVE-2026-75753

Certain ASUS routers are affected by a Missing Authentication for a Critical Function vulnerability. This flaw allows an unauthorized nearby user to send specific commands via HTTP requests , which can cause the router to reveal device identification information and switch into a specific mode. C...

CVE-2026-75753

Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a specific mode. As a result, when the router encounters abnormal...

CVE-2026-75753

Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a specific mode. As a result, when the router encounters abnormal...

EUVD-2026-104784

Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP requests, causing the router to return device identification information and switch into a specific mode. As a result, when the router encounters abnormal...

SUSE CVE-2026-73560

vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the MiMoV2OmniMultiModalProcessor in vllm/transformersutils/processors/mimov2omni.py passes attacker-controlled image and audio strings through fetchimage, requests.get, and Image.open instead of MediaConnector,...

CLEANSTART-2026-SR32951 In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service (DoS) condition

Security vulnerability affects the keycloak package. In Micrometer, it is possible for a user to provide specially crafted HTTP requests that may cause a denial-of-service DoS condition...

EUVD-2025-211136

IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 IBM Diamondback Tape Library and IBM Storage TS4500 Library could allow an authenticated user to cause a denial of service using specially crafted SMTP requests that would consume excessive amounts of system resources...

PT-2026-119878

Vulnerability in the iSupport product of Oracle E-Business Suite component: Service Requests. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport. While the vulnerability is in...

CVE-2016-20101: Improper Control of Filename for Include/Require Statement in PHP Program

Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/documento/requests/ajax-docs.php with a crafted abspath value...

Oracle E-Business Suite: CVE-2026-91347: Critical Patch Update

Vulnerability in the iSupport product of Oracle E-Business Suite component: Service Requests. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport. While the vulnerability is in...

Oracle E-Business Suite: CVE-2026-101844: Critical Patch Update

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite component: Concurrent Requests. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

PT-2026-119513

Vulnerability in the Oracle Concurrent Processing product of Oracle E-Business Suite component: Concurrent Requests. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

PT-2026-118388

Name of the Vulnerable Software and Affected Versions A2A Java SDK versions prior to 1.3.0.Final Description An unauthenticated caller can coerce the server into issuing HTTP requests to arbitrary internal and cloud-metadata endpoints from the server's own network position. This occurs because th...