CVE-2026-101363

A vulnerability exists in the Graph QL component of Oracle REST Data Services affecting supported versions 24.2.0-26.1.0 . An unauthenticated attacker with network access via HTTP can exploit this flaw to compromise the service, potentially resulting in unauthorized read access to a subset of acc...

CVE-2026-101362

A vulnerability exists in the Core component of Oracle REST Data Services (affected versions 24.2.0-26.1.0 ). An unauthenticated attacker with network access via HTTP can exploit this difficult to exploit vulnerability, though it requires human interaction from a person other than the attacker. S...

CVE-2026-101360

A vulnerability exists in the Oracle REST Data Services (component: Core ) affecting versions 24.2.0-26.1.0 . A low-privileged attacker with network access via HTTP can exploit this flaw to compromise the service, potentially gaining unauthorized read , update , insert , or delete access to some ...

CVE-2026-101359

A vulnerability exists in the Oracle REST Data Services (Core component) in versions 24.2.0-26.1.0 . An unauthenticated attacker with network access via HTTP can exploit this vulnerability to compromise the service. Successful exploitation can lead to unauthorized update, insert, or delete access...

CVE-2026-106173

CVE-2026-106173 — FortiSIEM Path Traversal Vulnerability Overview This repository documents CVE-2026-106173 , a reported path traversal vulnerability affecting Fortinet FortiSIEM. Path traversal vulnerabilities occur when an application fails to properly validate file paths, potentially allowing ...

CVE-2026-113724

A flaw was found in virtualenv. When cleaning up files, the deletion error-handling routine follows symbolic links when attempting to restore write permissions for removal. A local attacker can exploit this issue by planting a symbolic link pointing to a file owned by the executing user, causing...

CVE-2026-86411

An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...

CVE-2026-113867

A flaw was found in Thunderbird. Due to improper escaping of attribute values when serializing outgoing Extensible Messaging and Presence Protocol XMPP messages, incoming request data is reflected in automatic responses without sanitization. A remote attacker can exploit this flaw by sending a...

CVE-2026-113716

A flaw was found in virtualenv. When creating an isolated environment, directory validation resolves existing symbolic links symlinks rather than verifying the intended target destination. A local attacker could exploit this vulnerability by pre-creating a directory tree containing symlinks...

EUVD-2026-105276

An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...

CVE-2026-86411

An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...

CVE-2026-86411

An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...

CVE-2026-86411

An "ftp://" transfer configured with "CURLUSESSLNONE" can reuse a pooled FTP control connection that a previous easy handle upgraded with "STARTTLS" and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...

CVE-2026-112945

A flaw was found in Vite. An attacker can achieve arbitrary script execution in a user's browser by convincing a victim to load a crafted development server page when an application uses custom middleware. Due to improper handling of leading slashes in request URLs during HTML transformation, the...

CVE-2026-113386

A flaw was found in Roundcube Webmail. A remote authenticated attacker can exploit this vulnerability by injecting Carriage Return and Line Feed CRLF sequences into the uid parameter during message header or source viewing requests. This flaw enables the attacker to execute arbitrary Internet...

CVE-2026-113661

A flaw was found in sanitize-html. In configurations where meta refresh elements and their attributes are permitted, the sanitizer fails to properly filter unsafe scripts or redirect destinations within the refresh content value. A remote attacker could exploit this vulnerability by submitting...

CVE-2026-112939

A flaw was found in filelock. The SoftFileLock component can trust a forged process identifier PID in a lock marker file that an attacker can modify. A local attacker can exploit this flaw to cause an authorized process to act as a confused deputy, improperly removing an active lock marker and...

CVE-2022-31798

CVE-2022-31798 Exploit Title: Nortek Linear eMerge E3-Series - account takeover...

CVE-2026-112914

A flaw was found in filelock. A local attacker with write access to a shared lock directory can exploit the SoftFileLock mechanism to cause unauthorized file exposure. When filelock restores a stale lock marker by name, the attacker can swap in a symbolic link, causing the victim's process to...

CVE-2026-90153

A flaw was found in ksmbd, the in-kernel SMB3 server for Linux. The smbcheckpermdacl function incorrectly validates Access Control Entry ACE walks by using the remaining security descriptor length instead of the declared Discretionary Access Control List DACL size. This allows a remote attacker t...