CVE-2026-91331

A vulnerability exists in the Common Application Objects component of Oracle PeopleSoft Enterprise CC Common Application Objects version 9.2 . A high-privileged attacker with network access via HTTP can exploit this flaw to gain unauthorized read , update , insert , or delete access to specific a...

CVE-2026-70860

Oracle PeopleSoft PeopleSoft Enterprise FIN Common Objects Argentina (specifically the eProcurement component) version 9.1 is affected by a difficult to exploit vulnerability. A low-privileged attacker with network access via HTTP could compromise the system, potentially gaining unauthorized crea...

CVE-2026-101827

A vulnerability exists in the Oracle HCM Common Architecture product of Oracle E-Business Suite (specifically the Internal Operations component). This issue affects supported versions 12.2.3 through 12.2.15 . A low-privileged attacker with network access via HTTP can exploit this difficult-to-exp...

CVE-2026-101826

A vulnerability exists in the Oracle HCM Common Architecture product of Oracle E-Business Suite (specifically within the Internal Operations component). Affected versions include 12.2.3-12.2.15 . A low-privileged attacker with network access via HTTP can exploit this difficult-to-exploit vulnerab...

CVE-2026-101825

A vulnerability exists in the Internal Operations component of the Oracle HCM Common Architecture product within Oracle E-Business Suite . Affected versions are 12.2.3-12.2.15 . A low-privileged attacker with network access via HTTP can exploit this difficult-to-exploit vulnerability to compromis...

CVE-2026-101705

A vulnerability exists in the Oracle Common Applications product of Oracle E-Business Suite (component: Role Summary ), specifically affecting versions 12.2.3-12.2.15 . This high-complexity vulnerability allows a high-privileged attacker with network access via HTTP to compromise Oracle Common Ap...

CVE-2026-101583

A vulnerability exists in the helidon-common-mapper component of the Oracle Fusion Middleware Helidon product, specifically affecting versions 4.0.0-4.5.5 and 27.0.0 . This high-complexity vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the system. Succ...

CVE-2026-101569

A vulnerability exists in the helidon-common-concurrency-limits component of the Helidon product within Oracle Fusion Middleware . Affected versions include 4.0.0-4.5.5 and 27.0.0 . An unauthenticated attacker with network access via HTTP can easily exploit this flaw to gain unauthorized update, ...

A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...

GHSA-Q78C-5JJQ-57G8 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...

A2A Java SDK has a fail-open default task authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...

GHSA-QW47-MCM5-934W A2A Java SDK has a fail-open default task authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...

GHSA-JFGX-762W-99VR @angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

An incomplete fix for GHSA-58c5-g7wp-6w37 CVE-2025-66035 in @angular/common's HTTP Client HttpClient allows Cross-Site Request Forgery XSRF tokens to be leaked to attacker-controlled cross-origin domains when requests use URLs that exploit parsing discrepancies between regular expressions and the...

@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)

An incomplete fix for GHSA-58c5-g7wp-6w37 CVE-2025-66035 in @angular/common's HTTP Client HttpClient allows Cross-Site Request Forgery XSRF tokens to be leaked to attacker-controlled cross-origin domains when requests use URLs that exploit parsing discrepancies between regular expressions and the...

CVE-2026-70162

A flaw was found in dotnet. The Microsoft Common Object Runtime Library improperly handles incoming web requests. A remote, unauthenticated attacker could exploit this vulnerability by sending specially crafted web requests to an affected application, resulting in a Denial of Service DoS...

CVE-2026-111761

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...

EUVD-2026-105043

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...

CVE-2026-113466 MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It...

CVE-2026-113466

A security vulnerability exists in MinIO (up to RELEASE.2025-10-15T17-29-55Z) within the Embedded Console component. The flaw is located in the globalDeploymentID/SessionTokenAuthenticate function of the cmd/common-main.go file, which leads to the use of a hard-coded cryptographic key . This vuln...

Malicious code in fanarena-common (npm)

Source: ossf-package-analysis d81686cb5b877d15810946a299ba819a875a3304e45d65a3fdb83c5473ac664b The OpenSSF Package Analysis project identified 'fanarena-common' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...