PT-2026-80763

Name of the Vulnerable Software and Affected Versions resdata versions prior to 6.2.9 Description The software fails to correctly validate input within GRDECL files. This issue is particularly critical when the tool is used to parse untrusted files in networking contexts, such as webservices...

CVE-2026-60560

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: REST WebServices. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

PT-2026-62602

Name of the Vulnerable Software and Affected Versions Oracle Identity Manager versions 12.2.1.4.0 Oracle Identity Manager versions 14.1.2.1.0 Description A flaw in the REST WebServices component allows a low privileged attacker with network access via HTTP to compromise the system. Successful...

CVE-2026-60560: Improper Access Control

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: REST WebServices. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-36035

Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial of Service DoS via removing the license from the webserver...

CVE-2026-36035

The CAXPerts UniversalPlantViewer WebServices Server v2.7.6 is affected by an incorrect access control vulnerability in the /api/License/deactivateOffline endpoint. This flaw allows authenticated attackers with low-level privileges to perform a Denial of Service (DoS) attack by removing the licen...

CVE-2026-36035: Improper Access Control

Incorrect access control in the /api/License/deactivateOffline endpoint of CAXPerts UniversalPlantViewer WebServices Server v2.7.6 allows authenticated attackers with low-level privileges to cause a Denial of Service DoS via removing the license from the webserver...

Exploit for Eval Injection in Proofpoint Enterprise_Protection

About Security researcher: ly1g3, ly1g3attuta.io GPG finge...

CVE-2026-48958: Improper Access Control

An improper access check allows unauthorized users to create custom fields via webservices endpoints...

Joomla 3.0.x < 5.4.7 / 6.0.x < 6.1.2 Multiple Vulnerabilities (joomla-6-1-2-5-4-7-security-bugfix-release)

According to its self-reported version, the instance of Joomla! running on the remote web server is 3.0.x prior to 5.4.7 or 6.0.x prior to 6.1.2. It is, therefore, affected by multiple vulnerabilities. - An improper access check allows unauthorized users to create custom fields via webservices...

EUVD-2026-37400

Vulnerability in the Identity Manager product of Oracle Fusion Middleware component: REST WebServices. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager...

CVE-2026-35269: Undefined Security Weakness

Vulnerability in the Identity Manager product of Oracle Fusion Middleware component: REST WebServices. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager...

CVE-2026-35267: Undefined Security Weakness

Vulnerability in the Identity Manager product of Oracle Fusion Middleware component: REST WebServices. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Identity Manager...

org.apache.cxf:apache-cxf (2.6.2), org.apache.cxf:cxf-distribution-manifest (2.6.2) +5 more potentially affected by CVE-2026-50627 via org.apache.cxf:cxf-rt-rs-security-oauth2 (2.6.2)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version 2.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-rs-security-oauth2 and may be impacted: - org.apache.cxf:apache-cxf 2.6.2 - org.apache.cxf:cxf-distribution-manifest 2.6....

org.apache.cxf:apache-cxf (2.6.9), org.apache.cxf:cxf-distribution-manifest (2.6.9) +5 more potentially affected by CVE-2026-50627 via org.apache.cxf:cxf-rt-rs-security-oauth2 (2.6.9)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version 2.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-rs-security-oauth2 and may be impacted: - org.apache.cxf:apache-cxf 2.6.9 - org.apache.cxf:cxf-distribution-manifest 2.6....

org.apache.cxf:apache-cxf (2.6.9), org.apache.cxf:cxf-distribution-manifest (2.6.9) +5 more potentially affected by CVE-2026-50629 via org.apache.cxf:cxf-rt-rs-security-oauth2 (2.6.9)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version 2.6.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-rs-security-oauth2 and may be impacted: - org.apache.cxf:apache-cxf 2.6.9 - org.apache.cxf:cxf-distribution-manifest 2.6....

com.github.cchacin:cucumber-common-steps (>=0.0.2, <=0.1.8), com.github.httpmock:mock-http-server-junit (>=1.0.0, <=1.1.5) +9 more potentially affected by CVE-2026-50630 via org.apache.cxf:cxf-rt-rs-security-oauth2 (2.6.14)

org.apache.cxf:cxf-rt-rs-security-oauth2 MAVEN version 2.6.14 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-rs-security-oauth2 and may be impacted: - com.github.cchacin:cucumber-common-steps =0.0.2, =1.0.0, =1.0.0, =4.6.0.2,...

MAL-2026-4335 Malicious code in webservices.rest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c47c5da15de80c0473b9ccdb9899cb24607c3338914d67fe3331b169f5c1553b Package name webservices.rest impersonates the OpenMRS REST API naming convention and is published at version 99.1.0 — the canonical...

Malicious code in webservices.rest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c47c5da15de80c0473b9ccdb9899cb24607c3338914d67fe3331b169f5c1553b Package name webservices.rest impersonates the OpenMRS REST API naming convention and is published at version 99.1.0 — the canonical...

MAL-2026-4336 Malicious code in webservices.rest-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c9c78a4d0c87def69bbc5337e41a730e7ca6ae898426759915f053dc584581c package.json declares both preinstall and postinstall hooks that execute index.js, which exfiltrates installer data to a base64-encoded Cloudflare...