PT-2026-93840

Name of the Vulnerable Software and Affected Versions node-opcua-client versions prior to 2.145.0 Description The fieldsToJson function in the packages/node-opcua-client/source/alarms and conditions/client alarm.ts file directly assigns unsanitized field names. This allows a proto .pollutedKey pa...

Oracle WebCenter Enterprise Capture Client Bundle Full Control

The vulnerability of the Client Bundle component of the Oracle WebCenter Enterprise Capture software platform for automatic scanning, recognition, and digitization of documents is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker...

Linux Distros Unpatched Vulnerability : CVE-2026-92038

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153....

SUSE CVE-2026-89707

In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on followdown error nfsdcrossmnt initializes a local struct path with mntget and dget before calling followdown. On a negative return the error arm jumps to out without releasing those references: err =...

SUSE CVE-2026-92019

Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3...

SUSE CVE-2026-92038

Mitigation bypass in the Remote Settings Client component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3...

CVE-2026-81855

A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard...

CVE-2026-81855 Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key

A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard...

CVE-2026-81855 Wärtsilä FOS-Onboard Use of Hard-coded Cryptographic Key

A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard...

CVE-2026-81855

A hardcoded cryptographic client authentication key vulnerability exists in the robot testing framework component of Wärtsilä FOS-Onboard , a marine engine management platform. An attacker with network access and no prior privileges can exploit this to gain high confidentiality and high integrity...

CVE-2026-81926

Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmation dialog. The panel's check endpoint returned the submitted path unmodified in its JSON response, and client-side JavaScript inserted each value into the...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation through the CookieJar middleware accepting and storing a response cookie's Domain attribute without verifying that it matches the host that supplied the cookie or rejecting public suffixes. An attacker can cause cookies...

Session Fixation

Overview Affected versions of this package are vulnerable to Session Fixation through the CookieJar middleware accepting and storing a response cookie's Domain attribute without verifying that it matches the host that supplied the cookie or rejecting public suffixes. An attacker can cause cookies...

com.alejandrohdezma:scala-steward-core_2.13 (>=0.11.0, <=0.11.1), com.codacy:kamon-http4s-1.0_2.13 (>=0.0.1, <=0.1.2) +68 more potentially affected by CVE-2026-69215 via org.http4s:http4s-client_2.13 (>=1.0.0-m2, <=1.0.0-m46)

org.http4s:http4s-client2.13 MAVEN version =1.0.0-m2, =0.11.0, =0.0.1, =0.5.0, =1.3.0, =0.9.0-m2, =5.0.0-rc1, =5.0.0-rc1, =3.3.0-rc1, =0.0.1, =0.16.0, =0.0.73, =0.1.90, =0.1.90, =0.1.90, =0.2.4 and more Source cves: CVE-2026-69215 Source advisory: SNYK:JAVA-ORGHTTP4S-19851889...

Reliance on Cookies without Validation and Integrity Checking

Overview Affected versions of this package are vulnerable to Reliance on Cookies without Validation and Integrity Checking via the CookieJar process. An attacker can access sensitive session or authentication cookies by influencing outbound requests to attacker-controlled hostnames, leading to...

Reliance on Cookies without Validation and Integrity Checking

Overview Affected versions of this package are vulnerable to Reliance on Cookies without Validation and Integrity Checking via the CookieJar process. An attacker can access sensitive session or authentication cookies by influencing outbound requests to attacker-controlled hostnames, leading to...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the FollowRedirect process. An attacker can intercept sensitive credentials by inducing a redirect from HTTPS to HTTP on the same authority and observing the network traffic. Remediation Upgrade...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the FollowRedirect process. An attacker can intercept sensitive credentials by inducing a redirect from HTTPS to HTTP on the same authority and observing the network traffic. Remediation Upgrade...

CVE-2026-88742

Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting XSS in the client address field...

CVE-2026-87253

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Web Client. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require hum...