Red Hat: CVE-2026-86414: curl: curl: leaking host credentials to HTTP proxy

An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...

Totolink X2000R boa formIpv6Setup pppoe Stack-Based Buffer Overflow Vulnerabilities

Summary Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formWsc peerRptPin functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTT...

PT-2026-119888

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite component: Transaction Entry. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order...

PT-2026-120087

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain component: Product Quality Management. The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

PT-2026-119877

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Clean Content SDK. The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outsid...

PT-2026-119682

Vulnerability in the Oracle Service Bus product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Service Bus. Successfu...

Red Hat: CVE-2026-101356: tomcat: tomcat: Information disclosure via incorrect object recycling in HTTP/2 processing

Incorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.22 through 11.0.26, from 10.1.55 through 10.1.60, from 9.0.118 through...

Oracle E-Business Suite: CVE-2026-101841: Critical Patch Update

Vulnerability in the Global Order Promising product of Oracle E-Business Suite component: Web Service. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Global Order Promising. Whil...

PT-2026-119154

Vulnerability in the Oracle EDI Gateway product of Oracle E-Business Suite component: All Miscellaneous EDI Issues. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle EDI...

Oracle E-Business Suite: CVE-2026-101634: Critical Patch Update

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile...

PT-2026-119077

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Business Interlink. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterpris...

PT-2026-119509

Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite component: Award/PO. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise...

PT-2026-119993

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: QAS. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools...

PT-2026-118658

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup pppoe functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger...

PT-2026-119386

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM version 9.3.6 Description A flaw in the Application Server component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation requires human interaction and can lead to...

Oracle E-Business Suite: CVE-2026-87407: Critical Patch Update

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite component: Security. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications...

Oracle Siebel CRM Integration security vulnerabilities

The Oracle Siebel CRM Integration versions 25.12 to 26.9 have security vulnerabilities. These vulnerabilities stem from issues with the Open Integration component. Unauthorized attackers can access through the HTTP network. Without interaction from authorized users, this allows unauthorized...

Oracle WebCenter Portal security vulnerabilities

Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 have security vulnerabilities. These vulnerabilities stem from issues with the Runtime Tools component. Unauthorized attackers may gain access through HTTP network interactions, allowing them to access critical data or all accessible data...

PT-2026-119243

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Acollect. The supported version that is affected is 2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this...

PT-2026-119260

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-security-providers-jwt. Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While t...