CVE-2026-62530

Vulnerability in the Oracle HRMS France product of Oracle E-Business Suite component: French HR. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS France. Successful attac...

CVE-2026-62527

Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite component: Import And Export. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Learning...

CVE-2026-60160

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle ...

CVE-2026-60161

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle ...

CVE-2026-47055

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle ...

CVE-2026-47053

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle V...

CVE-2026-47043

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.12. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle ...

EUVD-2026-46394

Unsanitized user-supplied input in report filtering parameters is concatenated directly into SQL queries without proper escaping or parameterized queries, enabling blind SQL injection and unauthorized database read access...

EUVD-2026-46396

Improper Access Control CWE-284 in Kibana can lead to unauthorized modification of Entity Analytics Watchlist configuration and potential information disclosure. A low-privileged authenticated user with read-only Security Solution access could perform write operations on watchlist data that shoul...

EUVD-2026-46385

Unintended Proxy or Intermediary 'Confused Deputy' CWE-441 in Kibana can lead to unauthorized information exposure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Under certain conditions, a lower-privileged user can cause data from sources they are not authorized to access ...

CVE-2026-47697

Shelf is a platform for tracking physical assets. Shelf is multi-tenant; data is isolated per organization workspace. Prior to version 1.20.2, several endpoints accepted entity IDs from request input and connect-ed / read / updated them without verifying the IDs belonged to the caller's...

CVE-2026-63141 Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions

Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product endpoints...

CVE-2026-63141

This CVE (CVE-2026-63141) concerns Missing Authorization (CWE-862) in Kibana’s Cloud Connect feature. An authenticated user can access and modify Cloud Connect configuration and service settings via insufficiently protected endpoints. Affected versions include Kibana 9.3.x (9.3.0–9.3.7) and 9.4.x...

Kibana 9.3.8, 9.4.4 Security Update (ESA-2026-65)

Missing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions Missing Authorization CWE-862 in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct...

GHSA-RH79-75QM-GWJR Gitea LFS Deploy-Key Privilege Escalation

Vulnerability Header | Field | Value | | ------------------- | ----------------------------------------------------------- | | Vulnerability Title | Gitea LFS Deploy-Key Privilege Escalation | | Severity Rating | High | | Bug Category | Insufficient Authorization | | Location |...

CVE-2026-47697

Shelf is a multi-tenant platform for tracking physical assets. Prior to version 1.20.2, several endpoints accepted entity IDs from input and connected/read/updated them without verifying ownership, enabling cross-tenant IDOR where an authenticated user in Org A could access Org B’s data (assets, ...

CVE-2026-44878

CVE-2026-44878 affects HPE Aruba Networking EdgeConnect SD-WAN Gateways running ECOS. The vulnerability in the web-based management interface allows an authenticated, highly privileged remote attacker to access the device filesystem, with potential to read sensitive files and tamper with or delet...

EUVD-2026-41606

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories...

GHSA-7WVC-RVP7-W99X Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Summary A flaw in SSH LFS sub-verb handling allows any authenticated SSH user to obtain valid LFS credentials for any repository on the instance, including private repositories they have no access to. This enables unauthorized download of all LFS objects from any private repository. Details In...

GHSA-VXV2-8J6R-PCPG Gitea: OAuth token introspection returns metadata of tokens issued to other clients (RFC 7662 section 4 violation)

Live reproduction against Gitea 1.26.1 Setup: Gitea 1.26.1 docker stack with two users admin and victim and two OAuth applications owned by different users: Client A: id=5dda747d-7fdd-4694-85ff-ce4f893ce51e owner=admin Client B: id=588f778f-4a41-4914-ae01-85d776c369db owner=victim admin runs an...