Vulnerabilities in Oracle Fusion Middleware

Oracle has identified 153 vulnerabilities in various Oracle Fusion Middleware products, including Helidon, Oracle Access Manager, Oracle Coherence, Oracle Data Integrator, Oracle Forms, Oracle Fusion Middleware Control, Oracle Identity Manager, Oracle Identity Manager Connector, Oracle Internet...

CVE-2026-40854

CVE-2026-40854 affects the WNC T-Mobile 5G Box IDU router . The vulnerability resides in the portal.cgi component, where the session verification mechanism validates the sessionid cookie by checking for the existence of a corresponding file in /tmp/login_user . Because this check does not properl...

CVE-2026-40854 Session auth bypass via cookie value in T-Mobile 5G Box IDU routers

WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the sessionid cookie by checking for the existence of a corresponding file in /tmp/loginuser. An attacker can bypass authentication b...

DEBIAN-CVE-2026-89970

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...

CVE-2026-89970

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...

AZL-101460 CVE-2026-89970 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...

EUVD-2026-80570

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...

CVE-2026-89970 nvmet-auth: Synchronize timeout work during SQ teardown

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...

CVE-2026-89970

CVE-2026-89970 is a use-after-free vulnerability in the Linux kernel NVMe Target (nvmet) authentication subsystem. During Submission Queue (SQ) teardown, nvmet_auth_sq_free() uses cancel_delayed_work() to stop auth_expired_work, but if the work has already started, cancellation does not wait for ...

CVE-2026-89970 nvmet-auth: Synchronize timeout work during SQ teardown

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: Synchronize timeout work during SQ teardown nvmetauthsqfree cancels authexpiredwork with canceldelayedwork. If the work has already started, cancellation does not wait for the callback. Transport teardown can...

CVE-2026-14917

A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validateassertionsignature option is explicitly set to false. This option is enabled by default. When disabled, the plugin may extract the SAML identity from an unsigned assertion and authenticate the user without...

CVE-2026-14917

CVE-2026-14917 is a SAML authentication bypass in the Kong API Gateway Enterprise SAML plugin. When the validate_assertion_signature option is explicitly set to false (it is enabled by default ), the plugin extracts the SAML identity from an unsigned assertion without verifying a valid cryptograp...

CVE-2026-84439

An unauthenticated attacker can perform a log injection attack on Apache ZooKeeper (versions 3.9.0 through 3.9.5 and 3.8.0 through 3.8.6 ) when audit logging is enabled (zookeeper.audit.enable=true). By sending a digest authentication request containing tab characters ( ) in the username, an atta...

CVE-2026-86462

Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing database-backed sessions. An attacker who already holds a copy of the victim's session cookie keeps full access as that user after the password change, so th...

CVE-2026-86466 Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the idtoken it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be...

EUVD-2026-80327

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the idtoken it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be...

CVE-2026-86466

The apache-airflow-providers-fab package is vulnerable to an Origin Validation Error because the Authentik OAuth path in the FAB auth manager fails to validate the issuer or audience claims of accepted id_tokens. An attacker who possesses a valid token issued by the same Authentik identity provid...

CVE-2026-76186 Apache Airflow Keycloak provider: Keycloak token cookies not bound to Airflow session identity

Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two...

CVE-2026-82310 Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...

CVE-2026-82310 Apache Airflow FAB provider: FAB auth manager: deactivated users retain and renew Core API JWT access

Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentication correctly rejects the disabled account, but the Core API continues to accept an existing, unexpired token naming it, and lets that token mint a...