CVE-2026-10686

Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6routepacket subsys/net/ip were affected: the explicit-route path netroutepacket and the on-link cross-interface path netroutepacketif. Each set the packet...

DEBIAN-CVE-2026-64543

In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipcdiscrcv bearerdisable frees b-disc with tipcdiscdelete's plain kfree, but tipcdiscrcv still dereferences b-disc in RX softirq under rcureadlock tipcudprecv - tipcrcv - tipcdiscrcv...

EUVD-2026-47377

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Security. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM executes to compromise Oracle Agile PL...

EUVD-2026-47220

Vulnerability in the Oracle E-Business Tax product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle E-Business Tax...

EUVD-2026-47162

Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite component: Claim LOV. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trade Management...

EUVD-2026-47010

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware component: Web Content Management. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Orac...

EUVD-2026-46714

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Coherence...

EUVD-2026-46535

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: PIA Core Technology. Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft...

EUVD-2026-46517

Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite component: Bill Issues. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material...

CVE-2026-8285

Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation. This issue affects FlexCity: from 5.536.0 before 5.542.0...

PT-2026-62235

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 Description A flaw in the Console component of Oracle Fusion Middleware allows a high privileged attacker with network access via HTTPS to compromise the server...

PT-2026-63171

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Contracts Integration versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. Successful...

CVE-2026-16212

CVE-2026-16212 affects awesto django-shop up to 1.2.4. The vulnerability targets an unknown function in the file shop/models/inventory.py of the Purchase Stock Handler, causing a race condition. The issue can be exploited remotely with high complexity; exploitation status is publicly available (P...

EUVD-2026-43640

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from...

EUVD-2026-43093

vulnerability in Drupal Mother May I allows . This issue affects Mother May I versions:...

CVE-2026-58590 FlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-068

Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0...

CVE-2026-41042

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino. This issue affects Apache Gravitino: before 1.2.1. Users are recommended to upgrade to version...

CVE-2026-59520

Cross-Site Request Forgery CSRF vulnerability in properfraction CrawlWP SEO allows Cross Site Request Forgery. This issue affects CrawlWP SEO: from n/a through 3.0.16...

CVE-2026-13376 WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in spamBlocker Module

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WatchGuard Fireware OS spamBlocker module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-1071. This issue affects Fireware OS 12.0 up to and...

CVE-2026-13374

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in WatchGuard Fireware OS ConnectWise Technology Integration module allows Stored XSS. This vulnerability is an additional unmitigated attack path for CVE-2025-13937. This issue affects Firewar...