OSEC-2026-16 Path traversal in Cohttp.Path.resolve_local_file

The issue is that the function normalizes the URI path before percent decoding it: OCaml let resolvelocalfile docroot uri = let path = Uri.pctdecode path resolve "http" ofstring "/" uri in ... Because %2f is decoded after Uri.resolve, encoded separators survive dot-segment normalization. For...

K000163006: Next.js vulnerability CVE-2026-44575

Security Advisory Description Next.js is a React framework for building full-stack web applications. From 15.2.0 to before 15.5.16 and 16.2.5, App Router applications that rely on middleware or proxy-based checks for authorization can allow unauthorized access through transport-specific route...

CVE-2026-70867

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Oracle Application Testing Suite executes to...

CVE-2026-70843

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the...

CVE-2026-70717

Vulnerability in Oracle Autonomous Health Framework component: Cluster Health Analyzer. Supported versions that are affected are 26-26.1.0, 26.2.0, 26.3.1, 26.5.0 and 26.5.2. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attach...

CVE-2026-70691

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain component: Engineering Communication Interface. The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communicatio...

CVE-2026-70670

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware component: Security and Authentication. The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attach...

CVE-2026-62623

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware component: Security and Authentication. The supported version that is affected is 12.2.1.19.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment...

CVE-2026-62580

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with access to the physical communication segment attached to the...

CVE-2026-62578

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the...

CVE-2026-62545

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion component: Installation and Configuration. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communicatio...

CVE-2026-60993

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment...

EUVD-2026-62025

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain component: CAX Client. The supported version that is affected is 3.6. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware...

EUVD-2026-62020

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain component: CAX Client. The supported version that is affected is 3.6. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware...

EUVD-2026-61670

Vulnerability in Oracle Autonomous Health Framework component: Trace File Analyzer. Supported versions that are affected are 26-26.1.0, 26.2.0, 26.3.1, 26.5.0 and 26.5.2. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to...

EUVD-2026-61646

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain component: Engineering Communication Interface. The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communicatio...

EUVD-2026-61584

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the...

EUVD-2026-61585

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the...

EUVD-2026-61542

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion component: Installation and Configuration. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communicatio...

EUVD-2026-61422

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM component: Search. Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel...