45609 matches found
Oracle Applications Framework security vulnerabilities
Oracle Applications Framework is a MVC-based web development framework developed by Oracle, a company in the United States. Versions 12.2.9 to 12.2.15 of the Oracle Applications Framework contain security vulnerabilities. These vulnerabilities stem from issues with the Personalization component...
Oracle Application Development Framework security vulnerabilities
The Oracle Application Development Framework is an enterprise-level application development framework developed by Oracle, a company in the United States. Versions 12.2.1.4.0 and 14.1.2.0.0.0 of the Oracle Application Development Framework contain security vulnerabilities. These vulnerabilities...
CVE-2026-40939: Insufficient Session Expiration
The Data Sharing Framework DSF implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, OIDC-authenticated sessions had no configured maximum inactivity timeout. Sessions persisted indefinitely after login, even after the OIDC access token expired. This...
CVE-2026-40942: Always-Incorrect Control Flow Implementation
The Data Sharing Framework DSF implements a distributed process engine based on the BPMN 2.0 and FHIR R4 standards. Prior to 2.1.0, The OIDC JWKS and Metadata Document caches used an inverted time comparison isBefore instead of isAfter, causing the cache to never return cached values. Every...
CVE-2026-35243: Improper Access Control
Vulnerability in the Oracle Application Development Framework ADF product of Oracle Fusion Middleware component: ADF Faces. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where...
Data Sharing Framework Security Vulnerabilities
Data Sharing Framework is an open-source distributed medical data sharing and processing framework based on BPMN and FHIR. Versions of Data Sharing Framework prior to 2.1.0 contained security vulnerabilities, which were caused by the incorrect use of reverse time comparison logic in the OIDC and...
PT-2026-34122
Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Personalization. Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Application...
PT-2026-34160
Vulnerability in the Oracle Application Development Framework ADF product of Oracle Fusion Middleware component: ADF Faces. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where...
Fastify onRegister Function Use-After-Free
The vulnerability of the onRegister function in the Fastify framework, a Node.js software platform, is related to the occurrence of interpretation conflicts when processing HTTP headers’ names and values. Exploiting this vulnerability allows an attacker to compromise the confidentiality and...
CVE-2026-40320
Giskard is an open-source testing framework for AI models. In versions prior to 1.0.2b1, the ConformityCheck class rendered the rule parameter through Jinja2's default Template constructor, silently interpreting template expressions at runtime. If check definitions are loaded from an untrusted...
CVE-2026-35582
Emissary is a P2P based data-driven workflow engine. In versions 8.42.0 and below, Executrix.getCommand is vulnerable to OS command injection because it interpolates temporary file paths into a /bin/sh -c shell command string without any escaping or input validation. The INFILEENDING and...
Security Bulletin: DevOps Test Performance contains a vulnerability related to use of Spring Framework MVC and WebFlux
Summary Due to use of Spring Framework MVC and WebFlux, DevOps Test Performance and Rational Performance Tester contain a potential stream corruption vulnerability. Vulnerability Details CVEID:CVE-2026-22735 DESCRIPTION: Spring MVC and WebFlux applications are vulnerable to stream corruption when...
Fastify Node.js enhanceRequest Use-After-Free
The vulnerability of the enhanceRequest function in the Fastify Node.js software framework is related to the occurrence of interpretation conflicts when processing HTTP header names and values. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, an...
Multimodal Message Handler SSRF
The vulnerability of the Multimodal Message Handler component in the Spring AI development framework relates to insufficient validation of requests on the server side. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...
PT-2026-33726
Name of the Vulnerable Software and Affected Versions EasyFlow .NET affected versions not specified Description A SQL Injection flaw allows unauthenticated remote attackers to inject arbitrary SQL commands. This can lead to the unauthorized reading, modification, and deletion of database contents...
Owner-Harm: A Missing Threat Model for AI Agent Safety
Existing AI agent safety benchmarks focus on generic criminal harm cybercrime, harassment, weapon synthesis, leaving a systematic blind spot for a distinct and commercially consequential threat category: agents harming their own deployers. Real-world incidents illustrate the gap: Slack AI...
Zeek 8.0.7
Zeek is a powerful network analysis framework that is much different from the typical IDS you may know. While focusing on network security monitoring, Zeek provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Zeek ha...
Weaponizing the Commons: A Taxonomy and Detection Framework of Abuse on GitHub
GitHub plays a critical role in modern software supply chains, making its security an important research concern. Existing studies have primarily focused on CI/CD automation, collaboration patterns, and community management, while abuse behaviors on GitHub have received little systematic...
Microsoft.NET Framework DoS
The vulnerability of the Microsoft.NET Framework is related to synchronization errors when using a shared resource “Race Condition”. Exploiting this vulnerability can allow an attacker to cause service failures...
