CVE-2026-60304

CVE-2026-60304 affects Oracle Coherence (Core) within Oracle Fusion Middleware. Affects supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The flaw allows a low-privileged, network-accessible attacker (TCP) to cause a hang or repeatable crash (complete denial of service) in Or...

CVE-2026-47057

The CVE-2026-47057 entry concerns Oracle Java SE (Scripting) with affected versions listed as 8u491, 8u491-perf, and 11.0.31. The vulnerability is exploitable over the network via multiple protocols and can allow an unauthenticated attacker to cause a hang or crash (complete DOS). The flaw can be...

CVE-2026-47048

CVE-2026-47048 affects Oracle PeopleSoft Enterprise PeopleTools (component: Security) with affected versions 8.61 and 8.62. The issue is exploitable with network access via HTTP by a low-privilege attacker and requires user interaction. Successful attacks can lead to unauthorized read/update/inse...

CVE-2026-47038

...

EUVD-2026-46448

The DesignWare SPI driver drivers/spi/spidw.c computed the SPI BAUDR clock divider as info-clockfrequency / config-frequency without validating config-frequency. spitransceive is a Zephyr syscall and its verify handler drivers/spi/spihandlers.c copies the caller-supplied spiconfig from userspace...

CVE-2026-63912

A flaw was found in the Linux kernel's Encapsulating Security Payload ESP component. This vulnerability occurs in the ESP out-of-place fast path when handling combined single-fragment lengths. An attacker could potentially trigger a scenario where the system rejects the page-fragment fast path,...

CVE-2026-47695 CC-Tweaked has an SSRF Protection Bypass with NAT64

CC: Tweaked is a mod for Minecraft which adds programmable computers, turtles, and more to the game. Prior to version 1.119.0, CC-Tweaked's HTTP API http.request, http.websocket blocks requests to private network ranges to prevent server-side request forgery SSRF. This protection can be bypassed ...

CVE-2026-47695

CC-Tweaked has an SSRF protection bypass via NAT64. Before version 1.119.0, the HTTP API endpoints (http.request, http.websocket) could be tricked into reaching internal IPv4 services by supplying a NAT64 address in the URL (example: http://[64:ff9b::]/). The NAT64 prefix 64:ff9b::/96 is not reco...

CVE-2026-47667

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in loadanalyze, the headersize field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned charheadersize without being bounded against the actual file size. A value...

CVE-2026-47667 CImg Library: Uncontrolled Memory Allocation and Memory Leak in `_load_analyze()` via Crafted NIfTI/Analyze Header

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in loadanalyze, the headersize field is read as an unsigned int from the first 4 bytes of an Analyze/NIfTI file and passed directly to new unsigned charheadersize without being bounded against the actual file size. A value...

CVE-2026-63875

A flaw was found in the Linux kernel, specifically within the arm64 architecture's Translation Lookaside Buffer TLB management. When a Page Middle Directory PMD table was unshared, the TLB flush operation did not correctly invalidate entries in the walk cache. This oversight could leave stale PMD...

CVE-2026-63856

A flaw was found in the Linux kernel's AMDGPU Video Core Next VCN 2.0 component. This vulnerability arises because the VCN encoder and decoder rings do not properly support 64-bit user fence writes. An attacker could exploit this by submitting command sequences with 64-bit user fences, leading to...

CVE-2026-55081

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the scope query parameter into the generated HTML document without sufficient sanitization. A crafted scope value could be rendered a...

CVE-2026-24232

NVIDIA Tranformers4Rec contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure...

Security Bulletin: Multiple vulnerabilities within IBM HTTP Server, affect IBM Tivoli Monitoring.

Summary Multiple vulnerabilities within IBM HTTP Server which is included as part of IBM Tivoli Monitoring ITM portal server have been addressed. Vulnerability Details CVEID:CVE-2026-29167 DESCRIPTION: Use After Free vulnerability in Apache HTTP Server with modldap in per-directory configuration...

CVE-2026-21575

The CVE-2026-21575 entry concerns Sourcetree for Mac and Sourcetree for Windows, introduced in version 3.4.11. It is a High severity remote code execution (RCE) vulnerability that an authenticated attacker can exploit to execute arbitrary code with high impact to confidentiality, integrity, and a...

CVE-2026-47410 praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal "dev-secret-change-me" when PLATFORMJWTSECRET is unset. A safety check exists but only...

CVE-2026-47395

PraisonAI is a multi-agent teams system. Prior to version 4.6.40 of PraisonAI, corresponding to version 1.6.40 of praisonaiagents, PraisonAI's direct-prompt CLI automatically expands @url: mentions in raw prompt text before agent execution begins. If a prompt contains @url:, the CLI calls...

CVE-2026-24232

The CVE concerns NVIDIA Transformers4Rec, where improper deserialization of untrusted data is the root cause. This could allow code execution, data tampering, and information disclosure, as described in the CVE entry. The provided metrics indicate a low to medium impact with local attack vector a...

CVE-2026-47398 PraisonAI: Arbitrary code execution via unguarded `spec.loader.exec_module` in `agents_generator.py` - sibling of CVE-2026-44334

PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj added the PRAISONAIALLOWLOCALTOOLS env-var gate to the tooloverride.py sinks. However, two additional spec.loader.execmodule call sites in praisonai/agentsgenerator.py were...