32525 matches found
CVE-2026-62503
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Time and Labor...
CVE-2026-62504
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor...
CVE-2026-62494
Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor...
GHSA-FW57-JGCH-PGF3 Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
Summary The Locale middleware that runs in front of every unauthenticated request calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing a size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language...
Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests
Summary The Locale middleware that runs in front of every unauthenticated request calls golang.org/x/text/language.ParseAcceptLanguage on the raw Accept-Language header without imposing a size or shape filter. The underlying parser has quadratic-time behaviour on long lists of malformed language...
Gitea SSH Key Parser Denial of Service
Gitea's SSH key ingestion endpoint accepts keys in RFC 4716 SSH2 format and normalises them before storage. The normalisation function contains an ON² string concatenation loop with no input size limit, meaning a single malicious key submission can force the server to perform an amount of work th...
GHSA-M932-CRVM-GCP5 Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
Summary The AddTime API handler continues execution after an error returned by GetUserByName. When a repository administrator specifies a non-existent user name, an error response is generated but execution does not stop. Subsequent code dereferences a nil user pointer, resulting in a runtime...
Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service
Summary The AddTime API handler continues execution after an error returned by GetUserByName. When a repository administrator specifies a non-existent user name, an error response is generated but execution does not stop. Subsequent code dereferences a nil user pointer, resulting in a runtime...
GHSA-66M4-5JJR-2RG5 Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content
Affected product Gitea — services/repository/collaboration.go DeleteCollaboration + webhook delivery Summary When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's revocation cleanup...
Gitea: Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content
Affected product Gitea — services/repository/collaboration.go DeleteCollaboration + webhook delivery Summary When a collaborator with admin permission on a private repo creates a webhook, that webhook keeps firing after the collaborator's access is revoked. Gitea's revocation cleanup...
CVE-2026-44880
creationtimestamp| type| source ---|---|--- 2026-07-21 19:35:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6kjqlhyq27 2026-07-22 14:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mraldxwopq2n...
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
Impact The BER/CER/DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload tens of kilobytes containing an OID with many arcs consumes seconds of CPU per decode call, allowing denial of service in any application tha...
GHSA-8PPF-4F7H-5PPJ pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
Impact The BER/CER/DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload tens of kilobytes containing an OID with many arcs consumes seconds of CPU per decode call, allowing denial of service in any application tha...
CVE-2026-59140 Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths
Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths. The attach-time validator ssvalidateheader bounds only the root index against the node pool nodecapacity. The order-statistics and min/max queries th...
CVE-2026-44907
creationtimestamp| type| source ---|---|--- 2026-07-21 18:26:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6gnyyd4e2j...
CVE-2026-15432
When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in...
[SECURITY] [DLA 4691-1] rtpengine security update
------------------------------------------------------------------------- Debian LTS Advisory DLA-4691-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb July 20, 2026 https://wiki.debian.org/LTS -...
EUVD-2026-46318
When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in...
CVE-2026-28314
creationtimestamp| type| source ---|---|--- 2026-07-21 16:38:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6amsva4r23 2026-07-26 17:37:07+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mrkwayrphp26...
acl: TOCTOU Symlink Traversal via getfacl/setfacl
A time-of-check to time-of-use TOCTOU race condition vulnerability was found in acl. By replacing a pathname component with a symbolic link between a security check and subsequent file operations, an attacker can redirect file access control list operations. This occurs when privileged processes...