PT-2026-61939

Name of the Vulnerable Software and Affected Versions libssh affected versions not specified Description Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can remove integrity protection. This allows an in-path attacker to modify plaintext during transmission without...

PT-2026-63229

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle HRMS UK versions 12.2.3 through 12.2.15 Description A flaw in the UK Payroll component of Oracle HRMS UK allows a low privileged attacker with network access via HTTP to compromise the system. This issue can lead...

EulerOS Virtualization 2.12.0 : httpd (EulerOS-SA-2026-2775)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Buffer Over-read vulnerability in Apache HTTP Server.CVE-2026-34059 A NULL pointer dereference in moddavlock in Apache HTTP Server...

PT-2026-62076

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated user can cause a denial of service by submitting a specially crafted request to Entity Analytics endpoints. By providing an oversized input value, the attacker can trigger...

PT-2026-62766

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Applications Framework versions 12.2.3 through 12.2.15 Description A flaw in the Graph / Charting component of the Oracle Applications Framework allows a low privileged attacker with network access via HTTP to...

PT-2026-62452

Name of the Vulnerable Software and Affected Versions Oracle Access Manager versions 12.2.1.4.0 Oracle Access Manager versions 14.1.2.1.0 Description A flaw in the Authentication Engine component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful...

PT-2026-62985

Vulnerability in the Oracle Banking Trade Finance Process Management product of Oracle Financial Services Applications component: Common. Supported versions that are affected are 14.6.0-14.8.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

PT-2026-62081

Name of the Vulnerable Software and Affected Versions DayuanJiang next-ai-draw-io version 0.4.13 Description A remote attacker can obtain sensitive information by manipulating the X-Forwarded-For header value. Recommendations At the moment, there is no information about a newer version that...

PT-2026-62710

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Search Bean. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications...

CVE-2026-15904

Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

EUVD-2026-44406

Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability...

EUVD-2026-44396

Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability...

EUVD-2026-44392

Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability...

EUVD-2026-44355

Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability...

CVE-2026-47133

ClearanceKit on macOS stores per-record policy data in /Library/Application Support/clearancekit/store.db with ECDSA signatures in data_signatures. Prior to 5.0.10, the signed payload lacks a monotonic counter or freshness binding, allowing an attacker who can modify store.db and the matching dat...

CVE-2026-47133 ClearanceKit's signed policy tables lack monotonic counter, allowing replay of older legitimately-signed snapshots

ClearanceKit intercepts file-system access events on macOS and enforces per-process access policies. Prior to version 5.0.10, each table in the on-disk SQLite policy store /Library/Application Support/clearancekit/store.db is verified using an ECDSA signature stored in the datasignatures table. T...

GHSA-5X94-69RX-G8H2 Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

Description PIL/FontFile.py FontFile.compile assembles per-glyph images into a single combined bitmap using Image.new"1", xsize, ysize without calling Image.decompressionbombcheck. This is the base-class method shared by both BdfFontFile and PcfFontFile, and it is triggered whenever a loaded font...

BIT-NGINX-GATEWAY-2026-56434 NGINX ngx_http_ssi_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes SSI, proxypass, and proxybuffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle MITM abili...

CVE-2026-56452 Apache MINA SSHD: Path traversal in SCP file reception

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames...

dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation

A flaw was found in .NET Framework. An unauthorized attacker can exploit this vulnerability remotely by causing the system to allocate resources without proper limits or throttling. This uncontrolled resource allocation can lead to a Denial of Service DoS, making the affected system unresponsive ...