makes

⚠️ Deprecation notice ⚠️ After a thorough review of Makes and other build system alternatives, Fluid Attacks has decided to transition fully to Nix Flakes for all our builds. This decision brings significant benefits, including the opportunity to rely on and contribute to the incredible Nix...

EUVD-2026-105906

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Fluid Core. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise...

EUVD-2026-105902

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Fluid Core. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

CVE-2026-101490

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Fluid Core. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise...

CVE-2026-101486

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Fluid Core. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

CVE-2026-101490

A vulnerability exists in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools (affected versions 8.61-8.63 ). This easily exploitable flaw allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation requires human interaction ...

CVE-2026-101486

A vulnerability exists in the Fluid Core component of Oracle PeopleSoft Enterprise PeopleTools (affected versions 8.61-8.63 ). This easily exploitable flaw allows a low privileged attacker with network access via HTTP to compromise the product. The attack requires human interaction from a user ot...

CVE-2026-112240

The TYPO3 Fluid-Form by coding.ms (fluid_form) extension contains a broken access control vulnerability. The issue stems from a predictable token used in download links for files uploaded via forms, combined with insufficient verification of the file name in requests. This allows an unauthenticat...

CVE-2026-112240 Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was show...

CVE-2026-112240 Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

The download link for files uploaded through a form relied on a token that could be predicted. The file name in the request was also not verified in a way that resisted guessing. An unauthenticated attacker could use this to access files uploaded by other visitors. In addition, the token was show...

CVE-2026-113442 Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient...

CVE-2026-113442

The TYPO3 Fluid-Form by coding.ms extension (fluid_form ) is vulnerable to Cross-Site Scripting (XSS) due to a lack of input escaping. Specifically, values provided by visitors are inserted into the HTML summary email without proper sanitization. This allows an unauthenticated attacker to inject ...

CVE-2026-113442 Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient...

TYPO3-EXT-SA-2026-033: Broken Access Control in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-033...

TYPO3-EXT-SA-2026-033: Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)

More info at https://news.typo3.com/security/advisory/typo3-ext-sa-2026-033...

PT-2026-119178

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Fluid Core. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise...

PT-2026-119174

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Fluid Core. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

Oracle PeopleSoft Enterprise PeopleTools security vulnerabilities

Oracle PeopleSoft Enterprise PeopleTools versions 8.61 to 8.63 have security vulnerabilities. These vulnerabilities stem from issues with the Fluid Core component. Unauthorized attackers with low privileges may access the system via the HTTP network. This allows them to perform unauthorized...

TYPO3 Fluid-Form: Encryption issue vulnerability due to coding.ms

TYPO3 Fluid-Form: Versions from 6.0.0 to 6.0.6 and before, as well as 5.0.10, have security vulnerabilities. These vulnerabilities stem from the use of a predictable token in the download link for uploading files via forms. Additionally, the filename in the request does not undergo anti-guessing...

TYPO3 Fluid-Form: Cross-site scripting vulnerability due to coding.ms

TYPO3 Fluid-Form: Versions from 6.0.0 to 6.0.6 and 5.0.10 and earlier have a cross-site scripting vulnerability. This vulnerability arises due to values entered by visitors being placed in HTML digest emails without being escaped properly, allowing unauthenticated attackers to inject HTML into...