GHSA-GFC2-9QMW-W7VH Glances: Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS

Summary The Glances web server exposes a REST API /api/4/ that is accessible without authentication and allows cross-origin requests from any origin due to a permissive CORS policy Access-Control-Allow-Origin: . This allows a malicious website to read sensitive system information from a running...

Oracle WebLogic Server 安全漏洞

Oracle WebLogic Server is an application service middleware offered by Oracle Corporation in the United States. It serves both cloud and traditional environments. This product provides a modern, lightweight development platform that supports the entire lifecycle management of applications, from...

WWBN AVideo 安全漏洞

WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 29.0 contained security vulnerabilities. These vulnerabilities stemmed from the allowOrigin function in objects/functions.php, which allowed arbitrary Origin headers to be...

Oracle Financial Services Analytical Applications Infrastructure 安全漏洞

Oracle Financial Services Analytical Applications Infrastructure is a financial data analysis and modeling platform developed by Oracle Corporation. Versions 8.0.7.9, 8.0.8.7, and 8.1.2.5 of Oracle Financial Services Analytical Applications Infrastructure contain security vulnerabilities. These...

Oracle Financial Services Analytical Applications Infrastructure 安全漏洞

Oracle Financial Services Analytical Applications Infrastructure is a financial data analysis and modeling platform developed by Oracle Corporation. There is a security vulnerability in Oracle Financial Services Analytical Applications Infrastructure, which stems from issues with the Platform...

Oracle Agile Product Lifecycle Management for Process 安全漏洞

Oracle Agile Product Lifecycle Management for Process is a product lifecycle management system designed for the process industry by Oracle Corporation. Version 6.2.4 of Oracle Agile Product Lifecycle Management for Process contains a security vulnerability. This vulnerability stems from issues wi...

PT-2026-34119

Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft component: Purchasing. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM...

PT-2026-34109

Name of the Vulnerable Software and Affected Versions Oracle Identity Manager Connector version 12.2.1.4.0 Description An issue in the Core component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTPS to compromise the system. This can lead to unauthorize...

PT-2026-34142

Name of the Vulnerable Software and Affected Versions Oracle Financial Services Customer Screening version 8.1.2.8.0 Description An issue in the User Interface component allows an unauthenticated attacker with network access via HTTP to compromise the system. This can lead to unauthorized access ...

Oracle Financial Services Customer Screening 安全漏洞

Oracle Financial Services Customer Screening is a financial customer screening and risk identification system developed by Oracle Corporation. Version 8.1.2.8.0 of Oracle Financial Services Customer Screening contains a security vulnerability. This vulnerability stems from issues with the User...

mailcow: dockerized 安全漏洞

mailcow: dockerized is a Dockerized version of the mailcow open-source application. Versions before 2026-03b of mailcow have security vulnerabilities; these vulnerabilities stem from a second-level SQL injection in the quarantinecategory field, which may allow arbitrary SQL executions and the...

Oracle Financial Services Transaction Filtering 安全漏洞

Oracle Financial Services Transaction Filtering is a financial transaction screening system developed by Oracle Corporation. Version 8.1.2.8.0 of Oracle Financial Services Transaction Filtering contains a security vulnerability. This vulnerability stems from issues with the User Interface...

Frappe HR SQL注入漏洞

Frappe HR is an open-source human resources management system developed by Frappe. Versions of Frappe HR prior to 15.54.0 and 14.38.1 contained a SQL injection vulnerability. This vulnerability occurred due to specially crafted requests targeting certain endpoints, allowing attackers to extract...

WWBN AVideo 访问控制错误漏洞

WWBN AVideo is a video platform building system developed by the WWBN team using PHP. Versions of WWBN AVideo prior to 29.0 contained an access control vulnerability. This vulnerability stemmed from incomplete CORS origin validation repairs, as two code paths still reflected arbitrary Origin...

Oracle Identity Manager Connector 安全漏洞

Oracle Identity Manager Connector is an identity management integration component developed by Oracle, a US-based company. Version 12.2.1.4.0 of Oracle Identity Manager Connector contains a security vulnerability. This vulnerability stems from issues with the Core component, which may allow...

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Microsoft Dynamics 365 is a suite of ERP business solutions for multinational organizations from Microsoft USA. It is used for financial management, production management and business intelligence management. An information disclosure vulnerability exists in Microsoft Dynamics 365 On-Premises,...

PT-2026-34112

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware component: Core. The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identity Manager...

CVE-2026-34839 Glances Vulnerable to Cross-Origin Information Disclosure via Unauthenticated REST API (/api/4) due to Permissive CORS

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes a REST API /api/4/ that is accessible without authentication and allows cross-origin requests from any origin due to a permissive CORS policy Access-Control-Allow-Origin: . This...

Missing Authorization

Overview openmage/magento-lts is a This repository is the home of an unofficial community-driven project. Affected versions of this package are vulnerable to Missing Authorization through the MageWishlistSharedController shared wishlist item flow. An attacker can access or manipulate wishlist ite...

CVE-2026-40480

ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the GET /api/person/personId endpoint loads and returns person records without performing object-level authorization checks. Although the legacy PersonView.php page enforces canEditPerson restrictions, the API layer...