CVE-2026-48013

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...

CVE-2026-48013 Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation

Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the /api/action/media/external-link endpoint allows authenticated admin users to make server-side HTTP HEAD requests to arbitrary internal IP addresses. While the parallel uploadFromURL flow validates target IPs against...

CVE-2026-15037

Improper output neutralization XML injection in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under th...

EUVD-2026-48217

Unauthenticated Broken Access Control in Ebook Store = 6.19 versions...

EUVD-2026-48218

Unauthenticated Broken Access Control in Ebook Store = 6.19 versions...

CVE-2026-65453

Affected product: WordPress Ebook Store plugin, versions up to 6.19. The issue is an unauthenticated Broken Access Control vulnerability in Ebook Store

CVE-2026-61943

CVE-2026-61943 describes an unauthenticated Broken Access Control in the WordPress WPDM – Premium Packages plugin, affected versions

EUVD-2026-48202

Unauthenticated Broken Access Control in WPDM – Premium Packages = 6.2.0 versions...

EUVD-2026-48194

Subscriber Privilege Escalation in WP BASE Booking = 6.3.1 versions...

EUVD-2026-47918

The Customer Support Ticket System & Helpdesk plugin for WordPress is vulnerable to Code Injection via the 'path' parameter in all versions up to, and including, 6.0.5 due to the use of dynamic function invocation on an attacker-controlled value with insufficient validation. This makes it possibl...

EUVD-2026-47399

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain component: Install. The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering...

EUVD-2026-47400

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain component: Core. The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with network access via TCP to compromise Oracle Agile Engineering Data...

EUVD-2026-47394

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain component: Install. The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile Engineering Data...

EUVD-2026-47392

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain component: Installation. The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment...

CVE-2026-61190

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain component: Install. The supported version that is affected is 6.2.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile Engineering...

CVE-2026-61185

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain component: Installation. The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment...

CVE-2026-61179

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain component: Product Quality Management. The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2026-60583

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain component: Install. The supported version that is affected is 6.5.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Transportation Management...

CVE-2026-63924

A flaw was found in the Linux kernel's handling of IPv6 extended headers. Specifically, the ipv6hopjumbo function, which processes jumbo payloads, can modify internal packet buffer skb pointers. However, the network header nh pointer is not recomputed after these modifications. This oversight cou...

CVE-2026-63912

A flaw was found in the Linux kernel's Encapsulating Security Payload ESP component. This vulnerability occurs in the ESP out-of-place fast path when handling combined single-fragment lengths. An attacker could potentially trigger a scenario where the system rejects the page-fragment fast path,...