Oracle iSupport security vulnerabilities

A security vulnerability exists in Oracle iSupport versions 12.2.3 through 12.2.15. This vulnerability stems from issues within the Service Requests component and may allow low-privilege attackers to gain unauthorized access via HTTP, thereby accessing critical data or all accessible data...

Oracle Siebel CRM Cloud Applications security vulnerabilities

Oracle Siebel CRM Cloud Applications versions 22.3 to 26.9 have security vulnerabilities. These vulnerabilities stem from issues with the Siebel Cloud Manager component. Unauthorized attackers may gain access through HTTP network requests, allowing them to perform unauthorized updates, insert dat...

ASUS Router authorization issue vulnerability

The ASUS Router 3.0.0.4.388 series has an authorization issue vulnerability. This vulnerability stems from the lack of authentication for critical functions, allowing unauthorized nearby users to send specific commands via HTTP requests. This causes the router to return device identification...

Oracle WebCenter Sites security vulnerabilities

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 have security vulnerabilities. These vulnerabilities stem from issues with the WebCenter Sites component, which may allow unauthorized attackers to access critical data or all accessible data through HTTP network requests without proper...

Oracle WebCenter Sites security vulnerabilities

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 have security vulnerabilities. These vulnerabilities stem from issues with the WebCenter Sites component, which may allow unauthorized attackers to access critical data or all accessible data through HTTP network requests...

Permissive Cross-domain Policy with Untrusted Domains

Overview org.apache.camel:camel-jetty-common is a versatile open-source integration framework based on known Enterprise Integration Patterns. Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the enableCORS configuration in the Jetty...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection through XML parsing in the Smooks data format SmooksDataFormat and smooks: component SmooksProcessor in camel-smooks. An attacker can read files accessible to the Camel process or make it send requests ...

CVE-2026-112266

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...

CVE-2026-111883

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swar...

CVE-2026-112267 SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker

SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstraphost and bootstrapport fields. Attackers sending crafted requests to the Decode worker's...

CVE-2026-112267

SGLang versions through 0.5.22 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability when operating in prefill/decode disaggregation mode . The flaw exists in the Decode worker because the /generate endpoint fails to properly validate the client-supplied bootstrap_host and bootstra...

CVE-2026-112266 SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...

CVE-2026-112266 SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...

CVE-2026-112266 SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...

CVE-2026-112266

SGLang versions through 0.5.22 are vulnerable to a denial of service flaw caused by incorrect rid prefix matching logic. An API client can trigger a cross-request abort by submitting a streaming /generate request with a short, client-controlled rid (e.g., a single hex character) and then disconne...

CVE-2026-112266

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...

EUVD-2026-104320

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swar...

CVE-2026-111883

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swar...

Permissive Cross-domain Policy with Untrusted Domains

Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the createCorsHandler method in the Platform HTTP Vertx component. When CORS is enabled and camel.server.cors.origins is unset, an attacker can make a page on any origin send...

CVE-2026-88901

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component camel-smooks in Apache Camel allows an attacker...