CVE-2026-70716: Improper Access Control

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. Supported versions that are affected are 3.0.0-3.2.17 and 4.0.0-4.4.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successf...

PT-2026-78155

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon versions 4.0.0 through 4.5.0 Description A flaw in the Imperative Web Server component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead ...

PT-2026-77789

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Financial Reporting version 11.2.25.0.000 Description A flaw in the Server component allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system. Successful exploitati...

PT-2026-78126

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.14 Description A flaw in the Core component allows a high privileged attacker with access to the infrastructure where the software executes to compromise the system. This can lead to unauthorized read access to...

GitLab 18.2 < 18.11.11 / 19.0 < 19.0.8 / 19.1 < 19.1.6 / 19.2 < 19.2.4 (CVE-2026-19478)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allo...

CVE-2026-71141: Improper Access Control

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.14. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle ...

CVE-2026-70931: Improper Access Control

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Workflow...

PT-2026-77963

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 Description A flaw in the Installation and Configuration component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation...

CVE-2026-19478

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

CVE-2026-19478 Improper Control of Generation of Code ('Code Injection') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

CVE-2026-19478

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

CVE-2026-19478

GitLab CE/EE (self-managed) versions 18.2 through 19.2.3 are affected by a critical unauthenticated arbitrary method invocation vulnerability (CVSS 9.4, CWE-94) in the GraphQL API. The root cause is in the @gl_introduced directive's fallback field resolver (future_field_fallback.rb), which calls ...

CVE-2026-19478 Improper Control of Generation of Code ('Code Injection') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

BIT-JAVA-2026-47063

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and...

BIT-JAVA-2026-46968

Vulnerability in Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allow...

PT-2026-73349

Vulnerability in Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allow...

PT-2026-73337

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and...

PT-2026-73317

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and...

PT-2026-72166

The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding...

Oracle Enterprise Manager Base Platform Unauthorized Access

The vulnerability of the UI Framework component of the Oracle Enterprise Manager Base Platform is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker to gain unauthorized access to read, modify, or delete data, as well as cause service failures usin...