26282 matches found
CVE-2026-16454: Improper Access Control
In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability CWE-284 / CWE-862 has been identified in the Direct Device Integration DDI Controller. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned...
PT-2026-61982
Name of the Vulnerable Software and Affected Versions In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 In Progress ShareFile Storage Zones Controller versions prior to 6.0.2 Description An authenticated administrative user can exploit a path traversal vulnerability—a flaw...
PT-2026-62090
Name of the Vulnerable Software and Affected Versions aiflowy versions prior to 2.1.3 Description A Cross Site Scripting XSS issue exists where a remote attacker can obtain sensitive information. The flaw is located within the UploadController.java file. Recommendations Update aiflowy to version...
PT-2026-63047
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the...
PT-2026-63046
Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description An issue exists in the Endeca Application Controller component. An unauthenticated attacker with network access via HTTP can exploit this flaw to...
CVE-2026-15724: Improper Limitation of a Pathname to a Restricted Directory
In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated administrative user can exploit a path traversal vulnerability to read arbitrary files from the server filesystem, write files to arbitrary directories, or determine whether specific files exist on...
CVE-2026-52475
Cross Site Scripting vulnerability in aiflowy = 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file...
CVE-2026-61162: Improper Access Control
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the...
PT-2026-63028
Name of the Vulnerable Software and Affected Versions Oracle Communications Convergent Charging Controller version 15.0.0.0.0 Oracle Communications Convergent Charging Controller version 15.2.0.0.0 Description A flaw in the Prov IF component allows a high privileged attacker with network access v...
CVE-2026-61161: Improper Access Control
Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via...
CVE-2026-61143: Improper Access Control
Vulnerability in the Oracle Communications Convergent Charging Controller product of Oracle Communications component: Prov IF. Supported versions that are affected are 15.0.0.0.0 and 15.2.0.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to...
CVE-2026-51025
Cross Site Scripting vulnerability in fuint Member Marketing System =v1.0 allows a remote attacker to execute arbitrary code via the ClientMessageController.java file...
USN-8570-1 linux-gcp-6.17, linux-realtime-6.17 vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Foo-over-UDP FOU; - ARM64 architecture; - x86 architecture; - Block layer subsystem; - Drivers core; - Null block...
CVE-2026-64106
A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM for arm64 architecture, specifically within the virtual Generic Interrupt Controller vgic-its module. A local user in userspace can restore an Interrupt Translation Service ITS Device Table Entry DTE with a size field that...
RHEL 10 / 9 : Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update (Important) (RHSA-2026:42079)
The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:42079 advisory. Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT...
Linux Distros Unpatched Vulnerability : CVE-2026-63890
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scsi: fcoe: Reject FIP descriptors with zero fipdlen in CVL walker drivers/scsi/fcoe/fcoectlr.c::fcoectlrrecvclrvlink advanced the descriptor cursor by an...
Linux Distros Unpatched Vulnerability : CVE-2026-64169
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: spi: ep93xx: fix error pointer deref after DMA setup failure The driver falls back to PIO mo...
CVE-2026-51025
Cross Site Scripting vulnerability in fuint Member Marketing System =v1.0 allows a remote attacker to execute arbitrary code via the ClientMessageController.java file...
PT-2026-61733
Name of the Vulnerable Software and Affected Versions fuint Member Marketing System versions prior to 1.1 Description A Cross-Site Scripting XSS issue exists that allows a remote attacker to execute arbitrary code. The flaw is located within the ClientMessageController.java file. Recommendations...
