CVE-2026-19135

A JEXL expression sandbox bypass exists in multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user can submit a crafted expression to the Measurements REST API that escapes the sandbox and loads arbitrary Java classes on the server. This can potentially allow an...

Vulnerability of functions EllipticCurvePublicNumbers.public_key(), EllipticCurvePublicNumbers.public_key(), load_der_public_key(), and load_pem_public_key() in the Python-cryptography cryptographic library, which allows a perpetrator to gain access to confidential data

The vulnerabilities of the functions EllipticCurvePublicNumbers.publickey, EllipticCurvePublicNumbers.publickey, loadderpublickey, and loadpempublickey in the Python-cryptography cryptographic library are related to insufficient validation of data authenticity. Exploiting these vulnerabilities...

EUVD-2026-53835

Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration path, cause Polaris to use the catalog's storage credentials...

CVE-2026-12947 IBM App Connect Enterprise is vulnerable to Confidentiality disclosure on Discovery Connector nodes

IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user...

The vulnerability of the `ksmbd_kthread_fn()` function in the `fs/smb/server/transport_tcp.c` module, which is part of the SMB server support in Linux kernel, allows a hacker to gain unauthorized access to protected information.

The vulnerability of the ksmbdkthreadfn function in the fs/smb/server/transporttcp.c module of the SMB server support module in the Linux operating system involves the disclosure of confidential information. Exploiting this vulnerability could allow an attacker, acting remotely, to gain...

CVE-2026-64315

A flaw was found in the Linux kernel's Cryptographic Acceleration and Assurance Module CAAM driver. This vulnerability allows for the leakage of sensitive cryptographic key material. When the kernel's dynamic debugging feature is enabled, an attacker could potentially exploit improper handling of...

CVE-2026-64647

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the...

CVE-2026-64647

Summary: Next.js versions affected include 12.0.0–15.5.20 and 16.0.0–16.2.10. A server-side fetch with a request body can return a cached response body from a different request to the same URL when the request body uses a non-UTF-8 charset, causing confidential data in the POST response to leak t...

Cache Confusion

Next.js is vulnerable to Cache Confusion. The vulnerability is due to improper caching of server-side fetch responses, where cached response bodies may be reused across requests with different request bodies, allowing confidential data from one request to be exposed to unauthorized users...

Sensitive Information Exposure

Next.js is vulnerable to Sensitive Information Exposure. The vulnerability is due to improper caching of server-side fetch responses for non-UTF-8 request bodies, where different request bodies can share the same cache entry, allowing confidential response data to be exposed to unauthorized...

Johnson Controls XAAP Android

ADVISORY SUMMARY Successful exploitation of this vulnerability could result in an attacker obtaining confidential information from the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network...

EUVD-2026-47556

Vulnerability in the Oracle HRMS Norway product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS Norway. While...

EUVD-2026-47530

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor...

EUVD-2026-47471

Vulnerability in the Oracle Process Manufacturing Financials product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...

EUVD-2026-46910

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware component: Integration Business Insight. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-46680

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle...

CVE-2026-62560

Vulnerability in the Oracle HRMS Norway product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS Norway. While...

CVE-2026-61086

Vulnerability in the PeopleSoft Enterprise SCM Order Management product of Oracle PeopleSoft component: Security. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise SCM...

CVE-2026-61087

Vulnerability in the PeopleSoft Enterprise FIN Payables product of Oracle PeopleSoft component: Security. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise FIN Payables...

CVE-2026-60449

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware component: Content Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle WebCenter...