CVE-2026-61094

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high...

CVE-2026-60530

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware component: modhttp2.so. The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HTTP Server executes to compromis...

CVE-2026-60292

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server...

CVE-2026-60316

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: X Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Easily exploitable vulnerability allows high privilege...

CVE-2026-60585

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Replication. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high...

CVE-2026-60332

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication GCS. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows...

CVE-2026-60178

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Clone Plugin. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1. Difficult to exploit vulnerability allows high...

PT-2026-62288

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 Description An authentication procedure flaw in the Core component allows a low privileged attacker with network access to compromise the server via the SAML...

CVE-2026-60199: Missing Authentication for Critical Function

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

PT-2026-62681

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description An issue exists in the Content Server component of Oracle Fusion Middleware. A low privileged attacker with network access via HTTP can...

PT-2026-62285

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 Description A flaw in the Core component of Oracle Fusion Middleware allows a low privileged attacker with network access via HTTP to compromise the server...

PT-2026-62529

Name of the Vulnerable Software and Affected Versions Oracle HTTP Server versions 12.2.1.4.0 Oracle HTTP Server versions 14.1.2.0.0 Description A flaw in the Core component of Oracle Fusion Middleware allows a low privileged attacker with access to the infrastructure where the server executes to...

CVE-2026-63763

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users e.g., those with the database editor role can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the...

CVE-2026-63763 SurrealDB before 2.5.0 Privilege Escalation via Future Fields

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users e.g., those with the database editor role can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the...

CVE-2026-63763

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users e.g., those with the database editor role can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the...

CVE-2026-63763

SurrealDB contains a privilege escalation via a confused deputy when unprivileged users (e.g., with editor role) create or modify fields containing futures, functions, or closures. These are executed in the context of the invoking user, allowing planted logic to run with higher permissions on rea...

CVE-2026-63763: Authorization Bypass Through User-Controlled Key

SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users e.g., those with the database editor role can create or modify fields containing futures, functions, or closures. Because these are executed in the context of the...

MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability

ImpactCritical Sandbox Escape & Server Takeover:A critical security vulnerability exists in mcp-run-python due to a lack of isolation between the Python runtime Pyodide and the host JavaScript environment.The runPython and runPythonAsync functions execute Python code using Pyodide without...

PYSEC-2026-2628 MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability

Impact Critical Sandbox Escape & Server Takeover: A critical security vulnerability exists in mcp-run-python due to a lack of isolation between the Python runtime Pyodide and the host JavaScript environment. The runPython and runPythonAsync functions execute Python code using Pyodide without...

CVE-2026-48307

creationtimestamp| type| source ---|---|--- 2026-07-01 09:45:23+00:00| seen| https://www.cert.dk/news/2026-07-01/Kritiske-ColdFusion-saarbarheder-aabner-for-fuld-serverovertagelse 2026-07-01 13:00:13+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mpll4ubpnt2q 2026-07-08...