Oracle E-Business Suite: CVE-2026-101535: Critical Patch Update

Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite component: Security API. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Foundation...

PT-2026-118759

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Improper input validation in an API allows a remote attacker to potentially execute arbitrary code inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome ...

PT-2026-118323

A security vulnerability has been detected in arizu-id fast-tunnel 1.0.0. Affected by this issue is the function ZipArchive::extractTo of the file backend/api plugins.php of the component Plugin Installer. Such manipulation of the argument plugin file leads to unrestricted upload. The attack may ...

CVE-2026-59387 - broken access control restriction in Cloud Controller API | Cloud Foundry

Severity High CVSS score: 8.8 High CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Vendor Cloud Foundry Foundation Versions Affected CAPI Cloud Foundry Controller – Confirmed in CAPI up to v1.245.0 inclusive Description The Nginx routing configuration for Cloud Controller blocks unauthenticated acce...

PT-2026-118600

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.1.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, when an operator has enabled --enable-helm for kustomize build, helmGlobals.configHome can point Helm's config and data directories at a repository-controlled location...

SUSE CVE-2026-112074

A security flaw has been discovered in Tencent ncnn up to 44b02dabdcf97499281a4692ebd65bad73dcf8b6. Affected by this issue is the function ncnn::yuv420sp2rgb of the file src/matpixel.cpp of the component Conversion API. The manipulation results in integer overflow. The attack can be launched...

CVE-2026-112371

A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclose...

CVE-2026-112372 H3C Magic NX15 upload importprofile path traversal

A weakness has been identified in H3C Magic NX15 V100R017. This affects the function importprofile of the file /api/upload. This manipulation of the argument fileName causes path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could...

CVE-2026-112372

A path traversal vulnerability exists in H3C Magic NX15 V100R017 . The issue is located in the importprofile function of the /api/upload file, where a lack of proper input validation on the fileName argument allows for path traversal. This weakness can be exploited remotely to access or manipulat...

CVE-2026-112371 H3C Magic NX15 RPC esps write code injection

A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can be executed remotely. The exploit has been publicly disclose...

CVE-2026-112371

A code injection vulnerability exists in the RPC Interface component of H3C Magic NX15 NX15V100R017 . Specifically, the write function of the /api/esps file is affected. By manipulating the argument path , a remote attacker can achieve code injection . The vulnerability is exploitable remotely, a...

CVE-2026-53995

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit...

CVE-2026-105815

TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, allowing an unauthenticated...

CVE-2026-105814

TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera...

Malware in api-anthropic

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

grafana: grafana: Denial of Service via unbounded request body size in Prometheus rule conversion API

A flaw was found in Grafana. The Prometheus rule conversion API endpoints fail to enforce a limit on request body sizes. An authenticated user can exploit this vulnerability by submitting excessively large requests to trigger unbounded memory allocation, which crashes the server and results in a...

CVE-2026-105815

The TP-Link Tapo C210 (V3.60) is vulnerable to an Improper Authentication flaw (CWE-287) where unauthenticated DS JSON API requests expose shared credential material and cryptographic metadata. An unauthenticated attacker on an adjacent network can leverage this exposed material as an administrat...

CVE-2026-105815 Credential Material Exposure Leading to Unauthorized Streamed Media-Session Access in TP-Link Tapo C210

TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The exposed shared credential can be accepted by the Streamd Digest authentication mechanism as an administrative password, allowing an unauthenticated...

CVE-2026-105814

The TP-Link Tapo C210 (V3.60) contains an authentication bypass vulnerability within the DS JSON API . The root cause is an order-dependent flaw where a crafted JSON request combining a protected operation with public onboarding-related fields causes inconsistent module-level authorization checks...

CVE-2026-105814 Order-Dependent Authentication Bypass in the DS JSON API in TP-Link Tapo C210

TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protected operation and public onboarding-related fields may cause module-level authorization checks to be applied inconsistently, allowing protected camera...