PT-2026-62643

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft PeopleSoft Enterprise CS Student Records version 9.2.38 Description A flaw in the Higher Ed Statistics Agency - UK HESA component allows an unauthenticated attacker with network access via HTTP to compromise the system. This...

PT-2026-62174

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6 Description An issue exists in the Folders, Files & Attachments component of the Oracle Agile PLM product. An unauthenticated attacker with network access via HTTP can compromise the system, provided there is hum...

CVE-2026-50755

An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header value...

CVE-2026-50755

CVE-2026-50755 affects DayuanJiang’s next-ai-draw-io 0.4.13. The issue enables an attacker to obtain sensitive information by manipulating the X-Forwarded-For header, leading to potential information disclosure. The publicly provided details describe the vulnerability as a remote-access risk with...

PT-2026-62635

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft Enterprise FIN Cash Management version 9.2 Description An issue in the Cash Management component allows an unauthenticated attacker with network access via HTTP to compromise the system. Although the flaw is located within...

PT-2026-62667

Name of the Vulnerable Software and Affected Versions Oracle JDeveloper versions 12.2.1.4.0 Oracle JDeveloper versions 14.1.2.0.0 Description A flaw in the Data Visualization Tools component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise...

PT-2026-62366

Name of the Vulnerable Software and Affected Versions Oracle Coherence versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 Description An issue in the Core component of Oracle Coherence allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful...

PT-2026-62049

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An Unintended Proxy or Intermediary issue, also known as a Confused Deputy, occurs when a lower-privileged user can manipulate the system to process data from unauthorized sources using the...

PT-2026-62816

Name of the Vulnerable Software and Affected Versions Oracle Price Protection versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to unauthorized read access t...

PT-2026-62375

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 Description A flaw in the WLS - Web Services component of Oracle Fusion Middleware allows an unauthenticated remote attacker to compromise the server via the HTT...

PT-2026-62524

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description An issue exists in the Content Server component of Oracle WebCenter Content. An unauthenticated attacker with network access via HTTP can...

Permissive Cross-domain Policy with Untrusted Domains

Overview lightrag-hku is a LightRAG: Simple and Fast Retrieval-Augmented Generation Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains in the CORS configuration process. An attacker can gain unauthorized access to sensitive user data and...

CVE-2026-12341

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data due to improper validation of OAuth bearer tokens...

Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management

A flaw was found in the Apache Kafka Java producer client. A race condition in the client's buffer pool management can cause messages to be silently delivered to incorrect topics. This occurs when a message batch expires while its network request is still active, leading to premature buffer...

USN-8569-1 linux-hwe-7.0 vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. CVE-2025-54505 It was discovered that some AMD Zen 2 processors did not properly isolate shared...

USN-8567-1: Linux kernel vulnerabilities

It was discovered that some AMD processors did not properly clear data in the floating point divider unit during speculative execution. A local attacker could use this to expose sensitive information. CVE-2025-54505 It was discovered that some AMD Zen 2 processors did not properly isolate shared...

CVE-2026-21824

Technical details are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-45937

Network-AI npm: network-ai versions 5.12.2 through 5.13.3 fail to apply the configured authorization check checkAuth/secret to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET...

CVE-2026-64622 Network-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox

Network-AI npm: network-ai versions 5.12.2 through 5.13.3 fail to apply the configured authorization check checkAuth/secret to the ApprovalInbox GET read routes, so even when an operator configures a secret, unauthenticated actors can access sensitive approval request details. The GET...

CVE-2026-64622

Network-AI (npm: network-ai) versions 5.12.2–5.13.3 are affected by missing authorization on the ApprovalInbox read routes. Specifically, the GET routes /approvals/?status=all, /approvals/:id, /approvals/stats, and /approvals/sse fail to apply the configured authorization check (checkAuth/secret)...