Oracle WebCenter Sites security vulnerabilities

Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 have security vulnerabilities. These vulnerabilities stem from issues with the WebCenter Sites component, which may allow unauthorized attackers to access critical data through HTTP network requests, as well as access all accessible data...

Oracle PeopleSoft Enterprise PeopleTools security vulnerabilities

A security vulnerability exists in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63. This vulnerability stems from issues in the Portal component and may allow low-privilege attackers to access certain accessible data via HTTP requests while interacting with users, thereby...

Oracle Identity Manager Connector security vulnerabilities

The Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 have security vulnerabilities. These vulnerabilities stem from issues with the Generic REST component. Unauthorized attackers may gain access through HTTP network requests, allowing them to access critical data or fully acce...

TOTOLINK X2000R Buffer Error Vulnerability

The TOTOLINK X2000R has a buffer overflow vulnerability. This vulnerability stems from a stack buffer overflow in the batchupg function. Custom HTTP requests can lead to arbitrary code execution. Attackers can exploit this vulnerability through authenticated HTTP requests...

Permissive Cross-domain Policy with Untrusted Domains

Overview org.apache.camel:camel-jetty-common is a versatile open-source integration framework based on known Enterprise Integration Patterns. Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the enableCORS configuration in the Jetty...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection through XML parsing in the Smooks data format SmooksDataFormat and smooks: component SmooksProcessor in camel-smooks. An attacker can read files accessible to the Camel process or make it send requests ...

CVE-2026-112266

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...

CVE-2026-111883

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swar...

CVE-2026-112267 SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker

SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger outbound requests via client-supplied bootstraphost and bootstrapport fields. Attackers sending crafted requests to the Decode worker's...

CVE-2026-112267

SGLang versions through 0.5.22 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability when operating in prefill/decode disaggregation mode . The flaw exists in the Decode worker because the /generate endpoint fails to properly validate the client-supplied bootstrap_host and bootstra...

CVE-2026-112266 SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...

CVE-2026-112266 SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...

CVE-2026-112266 SGLang through 0.5.22 Cross-Request Abort via rid Prefix Matching

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...

CVE-2026-112266

SGLang versions through 0.5.22 are vulnerable to a denial of service flaw caused by incorrect rid prefix matching logic. An API client can trigger a cross-request abort by submitting a streaming /generate request with a short, client-controlled rid (e.g., a single hex character) and then disconne...

CVE-2026-112266

SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests by supplying a short client-controlled rid. Attackers can submit streaming /generate requests with single hex character rids and disconnect, triggering...

EUVD-2026-104320

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swar...

CVE-2026-111883

Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistics via GET requests to /stop and /stats/reset. Attackers can lure an operator to a malicious page triggering cross-site GET requests, terminating running swar...

Permissive Cross-domain Policy with Untrusted Domains

Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the createCorsHandler method in the Platform HTTP Vertx component. When CORS is enabled and camel.server.cors.origins is unset, an attacker can make a page on any origin send...

CVE-2026-88901

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from 4.19.0 before 4.22.1. Improper Restriction of XML External Entity Reference in the Smooks component camel-smooks in Apache Camel allows an attacker...

CVE-2026-85313

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which acce...