PT-2026-72072

Name of the Vulnerable Software and Affected Versions Capstone versions prior to 6.0.0-Alpha9 Description The public cs insn name API forwards caller-supplied instruction IDs directly to the selected architecture backend. In the M68K and RISCV backends, missing or incomplete bounds checks allow a...

PT-2026-104472

Уязвимость системы управления интернет-магазином ReadyScript связана с неправильной реализацией последовательности выполняемых действий. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, оказать воздействие на конфиденциальность, целостность и доступность защищаемой...

7zip-26.02-2.1 on GA media (moderate)

7zip-26.02-2.1 on GA media Announcement ID: openSUSE-SU-2026:11502-1 Rating: moderate Cross-References: CVE-2026-48092 CVE-2026-48101 CVE-2026-48102 CVE-2026-48103 CVE-2026-48104 CVE-2026-48111 CVE-2026-48112 CVSS scores: CVE-2026-48092 SUSE : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N...

Siebel Approval Manager Data Compromise

The vulnerability of the Siebel Approval Manager component, a tool for configuring, customizing, and integrating CRM systems, is related to insecure privilege management. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of...

Metadata Plugin Oracle Enterprise Manager Data Compromise

The vulnerability of the Metadata Plugin component of the Oracle Enterprise Manager Base Platform is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...

Metadata Plugin Oracle Enterprise Manager Data Compromise

The vulnerability of the Metadata Plugin component of the Oracle Enterprise Manager Base Platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information by using t...

Deployment Library Oracle Enterprise Manager Data Compromise

The vulnerability of the Deployment Library component of the Oracle Enterprise Manager Base Platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information by usin...

SAP NetWeaver OS Command Injection (3745182)

The version of the SAP NetWeaver kernel detected on the remote host is affected by an OS command injection vulnerability as referenced in SAP Security Note 3745182: - SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls...

Linux Distros Unpatched Vulnerability : CVE-2026-56859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion. CVE-2026-56859 Note that Nessus relies on...

PT-2026-72082

Name of the Vulnerable Software and Affected Versions Capstone versions prior to 6.0.0-Alpha9 Description The WebAssembly backend accepts attacker-controlled raw WASM instruction bytes through the cs disasm and cs disasm iter APIs. When processing a large but well-formed br table instruction, the...

UBUNTU-CVE-2026-73416

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces...

CVE-2026-73416

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces...

Inefficient Algorithmic Complexity

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the indexing. An attacker can degrade the availability of indexing operations on the affect...

CVE-2026-72685

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the...

CVE-2026-72680

Summary: CVE-2026-72680 affects Kibana Agent Builder via the A2A JSON-RPC API. An authenticated user with only read privileges can supply a user-owned identifier for a conversation that already exists in the same space and cause that conversation to be replaced and reassigned to the attacker, res...

EUVD-2026-58249

A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a crafted user-supplied input. Processing one such document occupies a worker thread from a bounded pool for a disproportionate amount of time, degrading the...

CVE-2026-73562

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOnefilter, req.body can exploit Mongoose update casting with a proto.x dotted path under $set...

CVE-2026-73562

CVE-2026-73562 describes a prototype-pollution vulnerability in Mongoose (MongoDB object modeling tool) via update casting that can occur when a user-controlled update uses a proto -prefixed dotted path under $set. Prior to versions 6.13.10, 7.8.10, 8.24.1, and 9.7.2, schema logic can treat inher...

EUVD-2026-58176

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOnefilter, req.body can exploit Mongoose update casting with a proto.x dotted path under $set...

CVE-2026-73562 Mongoose: Prototype pollution in the update casting via __proto__-prefixed dotted path (Schema._getSchema/path getter)

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Prior to 6.13.10, 7.8.10, 8.24.1, and 9.7.2, passing a user-controlled update such as MyModel.updateOnefilter, req.body can exploit Mongoose update casting with a proto.x dotted path under $set...