CVE-2026-93540 Fleet applies namespace labels and annotations without the bundle's service account privileges

A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a...

CVE-2026-53627 GLPI: Unexpected access to update operations through the API

GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, a low-privileged authenticated user can use the new API v2 to perform update operations that the same user is normally forbidden to perform through the user interface. The API update flow does not consistently...

CVE-2026-83242: Improper Access Control

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Experience Manager. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2026-83431: Improper Authorization

Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite component: WebUI. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Workbench. Successf...

GO-2026-6334 Gitea pull request branch permission checks allow unauthorized updates and rebases in code.gitea.io/gitea

Gitea pull request branch permission checks allow unauthorized updates and rebases in code.gitea.io/gitea...

CVE-2026-70766: Improper Access Control

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion component: Server. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial...

CVE-2026-62577: Improper Access Control

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion component: Installation and Configuration. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Orac...

CVE-2026-71121: Improper Access Control

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial...

CVE-2026-62511: Improper Access Control

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion component: Installation and Configuration. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where...

CVE-2026-71147: Improper Access Control

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financia...

CVE-2026-70775: Improper Access Control

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: User Interface. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Installed Base...

CVE-2026-61198: Improper Access Control

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Learning...

CVE-2026-71019: Improper Access Control

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Internal operations. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

CVE-2026-73891: Improper Access Control

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this...

CVE-2026-70852: Improper Access Control

Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain component: Internal Operations. Supported versions that are affected are 12.1 and 12.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Demand Planning...

CVE-2026-70683: Improper Access Control

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Calculation...

EUVD-2026-56784

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.2.2, processUpdateActivity and processUpdateVideo accept an ActivityPub Update containing a Video object without verifying that byActor.url is authorized for the host in videoObject.id, allowing a malicious federated server...

CVE-2026-72595

CVE-2026-72595 : In BadChoice Handesk, the vulnerability affects the TicketsController@update endpoint where no authorization check is performed and no team-scoped ownership is enforced. This allows any authenticated agent to update ticket records belonging to other teams, enabling modification, ...

EUVD-2026-46646

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-61221

Vulnerability in the Oracle Item Master product of Oracle E-Business Suite component: iSet-up bugs. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Item Master. Successful...