PT-2026-63040

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search Platform Services version 11.4.0 Description An issue exists in the Forge component of Oracle Commerce Guided Search Platform Services. An unauthenticated attacker with network access via HTTP can compromise the...

PT-2026-62253

Name of the Vulnerable Software and Affected Versions MySQL Cluster versions 8.0.0 through 8.0.47 Description An issue exists in the Server: Optimizer component of MySQL Cluster. A high privileged attacker with network access via multiple protocols can exploit this flaw to cause a hang or a...

PT-2026-62078

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in load analyze, the header size field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned charheader size without being bounded against the actual file size. A...

PT-2026-61858

Name of the Vulnerable Software and Affected Versions libssh affected versions not specified Description A flaw exists where a remote authenticated peer can advertise a zero maximum packet size within the SSH MSG CHANNEL OPEN message. This causes subsequent channel writes to enter an infinite loo...

Exploiting Load/Store Leakage of Sparse Vectors for Key Recovery in HQC

Hamming Quasi-Cyclic HQC is a code-based key encapsulation mechanism selected by NIST for standardization, making its resistance to implementation attacks critically important. We present a side-channel attack that exploits load/store leakage in the manipulation of HQC's sparse secret vectors...

PT-2026-62690

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description An issue exists in the Web Content Management component of Oracle Fusion Middleware. A low privileged attacker with network access via HTTP can...

PT-2026-61854

Name of the Vulnerable Software and Affected Versions Apache Fory versions 0.5.0 through 1.3.x Description An out-of-bounds read occurs via sun.misc.Unsafe when out-of-band zero-copy deserialization is utilized. In this scenario, the readAlignedVarUint function can read data beyond the boundaries...

PT-2026-63030

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Content Acquisition System component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successf...

PT-2026-63020

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce component: Dynamo Application Framework. The supported version that is affected is 11.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Commerce Platform...

Security update for chromium (important)

openSUSE security update: security update for chromium ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21382-1 Rating: important References: bsc1271656 Cross-References: CVE-2026-15899 CVE-2026-15900 CVE-2026-15901 CVE-2026-15902 CVE-2026-15903...

EUVD-2026-43741

Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 stream handling of lib/adapters/http.js, which does not enforce maxBodyLength on stream...

Directus: SSRF Protection Bypass via 0.0.0.0 in File Import

Summary The SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0. While 127.0.0.1 and other internal addresses are denied, 0.0.0.0 is not added to the blocklist. On Linux and macOS, connecting to 0.0.0.0 reaches localhost, so an authenticated user...

GHSA-J5H6-VQC3-PHQH Directus: SSRF Protection Bypass via 0.0.0.0 in File Import

Summary The SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0. While 127.0.0.1 and other internal addresses are denied, 0.0.0.0 is not added to the blocklist. On Linux and macOS, connecting to 0.0.0.0 reaches localhost, so an authenticated user...

EUVD-2026-44672

Directus: SSRF Protection Bypass via 0.0.0.0 in File Import...

EUVD-2026-46116

nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets concrete and abstract. This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version...

CVE-2026-56452

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames...

CVE-2026-44584

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified statu...

EUVD-2026-41902

Pillow BdfFontFile: Image.new called without decompressionbombcheck — bomb protection bypass via font loading...

CVE-2026-47130 NextCRM has a BOLA/IDOR in PATCH /api/crm/contacts/[id] that allows Cross-Tenant CRM Data Tampering

NextCRM is open-source customer relationship management CRM software. Versions prior to 0.12.0 have a Broken Object Level Authorization BOLA/IDOR vulnerability exists in the CRM contact and target update endpoints. The application fails to verify if the authenticated user has ownership of the...