Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via missing authentication tag verification in the experimental Chacha20Poly1305 key-encryption algorithm. An attacker can modify an encrypted content-encryption key CEK in transit withou...

PYSEC-2026-2281

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s...

fusion (0.1.0), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-48818 via starlette (0.47.0)

starlette PYPI version 0.47.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fusion 0.1.0 - geo-importer =0.0.1b1, =0.3.0, =0.1.2, =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-48818 Source advisory: OSV:PYSEC-2026-2281...

exchange-radar (1.0.0), lila-framework (>=0.2.0, <=0.2.5) +3 more potentially affected by CVE-2026-48818 via starlette (0.30.0)

starlette PYPI version 0.30.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - exchange-radar 1.0.0 - lila-framework =0.2.0, =0.1.88, =0.2.1a0, =0.2.2a0 Source cves: CVE-2026-48818 Source advisory: OSV:PYSEC-2026-2281...

fastapi (0.77.0), goe-framework (>=1.0.6.dev0, <=1.1.0) +1 more potentially affected by CVE-2026-48818 via starlette (0.19.0)

starlette PYPI version 0.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fastapi 0.77.0 - goe-framework =1.0.6.dev0, =0.2.6, =0.2.8 Source cves: CVE-2026-48818 Source advisory: OSV:PYSEC-2026-2281...

EUVD-2026-37221

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite component: Core. Supported versions that are affected are V15 and V16. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise...

EUVD-2026-37219

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite component: Core. Supported versions that are affected are V15 and V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Enterprise...

EUVD-2026-37387

Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite component: Core. Supported versions that are affected are V15 and V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise...

EUVD-2026-37361

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Extensibility Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromis...

EUVD-2026-37360

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Extensibility Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromis...

EUVD-2026-37358

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Extensibility Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where...

EUVD-2026-37339

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Security Framework. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

EUVD-2026-37335

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Discovery Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise...

EUVD-2026-37321

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Security Framework. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

EUVD-2026-37320

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Security Framework. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

EUVD-2026-37459

Vulnerability in the Oracle Application Development Framework ADF product of Oracle Fusion Middleware component: Security Framework. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

EUVD-2026-37461

Vulnerability in the Oracle Application Development Framework ADF product of Oracle Fusion Middleware component: ADF Faces. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where...

EUVD-2026-37773

Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s...

netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation

A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended...

dotnet: .NET: Local file tampering via link following vulnerability

A flaw was found in .NET's System.Formats.Tar library. When extracting a specially crafted TAR archive containing symbolic links, the TarFile.ExtractToDirectory method may incorrectly follow those links and write files outside the intended extraction directory. An attacker could exploit this issu...