golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input

A flaw was found in golang.org/x/text. The norm.Iter component can enter an infinite loop when processing input that contains invalid UTF-8 Unicode Transformation Format - 8-bit bytes. A remote attacker could exploit this vulnerability by providing specially crafted input, leading to a Denial of...

CVE-2026-65317 Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...

CVE-2026-65317

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...

CVE-2026-65317

Verba RAG application 2.1.3 is affected by a server-side request forgery (SSRF) vulnerability combined with a same-origin middleware bypass. An unauthenticated attacker can issue arbitrary outbound HTTP requests by supplying a crafted Origin header and attacker-controlled host/port values to the ...

CVE-2026-65317

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...

Security Bulletin: Multiple vulnerabilities has been identified in IBM WebSphere Application Server which is used by IBM Rational ClearQuest

Summary IBM WebSphere Application Server is used by the IBM Rational ClearQuest server. Information about security vulnerabilities affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

CVE-2026-65054 MediaCMS Private Media Metadata Disclosure via Playlist Ownership Loophole

MediaCMS 8.2.0 contains an information disclosure vulnerability that allows authenticated users to expose private media metadata belonging to other users by adding arbitrary media tokens to their own playlist without access control checks. Attackers can issue a PUT request to the playlist API...

GHSA-683J-3FF6-HH2X Gitea: Privilege Escalation via Access Token Scope Escalation in API

Gitea's API endpoint for creating Personal Access Tokens POST /users/username/tokens is protected by a middleware reqBasicOrRevProxyAuth that is intended to require password-based authentication, preventing a compromised token from being used to mint new ones. However, when a token is passed in t...

AZL-93105 CVE-2026-56852 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-6

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

CVE-2026-16317 Silent Drop of TLS 1.3 Encrypted Records in s2n-tls

Missing validation of the outer contenttype byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer contenttype of all...

CVE-2026-16317

The flaw affects s2n-tls (TLS 1.3) where the outer content_type byte is not covered by the AEAD tag because it is hardcoded in AAD instead of using the wire byte. This allows an active MITM to silently discard individual application_data records without detection, enabling selective suppression o...

com.codbex.atlas:codbex-atlas-application (>=2.111.0, <=14.81.0), com.codbex.hades:codbex-hades-application (>=2.81.0, <=14.62.0) +13 more potentially affected by CVE-2026-66010 via org.webjars.npm:dompurify (>=3.1.7, <=3.4.8)

org.webjars.npm:dompurify MAVEN version =3.1.7, =2.111.0, =2.81.0, =2.80.0, =2.73.0, =2.72.0, =1.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =13.6.0, =0.54.0, =0.56.0 Source cves: CVE-2026-66010 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-18170234...

EUVD-2026-46182

The Grav api plugin grav-plugin-api before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission the baseline...

CVE-2026-64627 Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

BIT-ARGO-CD-2026-45738 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/ annotations whose pipe-separated values are rendered by...

CVE-2026-15690

A flaw was found in open62541, a widely used open-source OPC UA Open Platform Communications Unified Architecture toolkit. A remote attacker could trigger a denial of service by sending a specially crafted request that manipulates a specific argument within the Shared Client Library. This...

PT-2026-62774

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Application Object Library versions 12.2.3 through 12.2.15 Description A flaw in the Core component of the Oracle Application Object Library allows a low privileged attacker with network access via HTTP to...

PT-2026-63004

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Application Object Library versions 12.2.3 through 12.2.15 Description An issue in the Core component of the Oracle Application Object Library allows an unauthenticated attacker with network access via HTTP to...

PT-2026-63002

Name of the Vulnerable Software and Affected Versions Oracle Application Object Library versions 12.2.3 through 12.2.15 Description An issue exists within the DB Privileges component of the Oracle Application Object Library. A low privileged attacker with network access via HTTP can compromise th...

PT-2026-63046

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description An issue exists in the Endeca Application Controller component. An unauthenticated attacker with network access via HTTP can exploit this flaw to...