CVE-2026-83123: Improper Access Control

Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager...

CVE-2026-83122: Improper Access Control

Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager...

PT-2026-92912

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to...

PT-2026-92983

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle HRMS India versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle HRMS India product. A low privileged attacker with network access via HTTPS can compromise...

PT-2026-92646

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Report Manager versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component of the Oracle Report Manager allows a low privileged attacker with network access via HTTPS to compromise the...

PT-2026-92676

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM versions 17.0 through 26.7 Description A flaw in the Server Infrastructure component of the Siebel CRM Deployment product allows a low privileged attacker with network access via HTTPS to compromise the system. Successful...

PT-2026-92691

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Applications Manager versions 12.2.3 through 12.2.15 Description A flaw in the Oracle Diagnostics Interfaces component of the Oracle Applications Manager allows a low privileged attacker with network access via...

PT-2026-92688

Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite component: User Interface. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Custom...

CVE-2026-50166: Improper Certificate Validation

Kuma is a modern Envoy-based service mesh that can run on every cloud across both Kubernetes and VMs. Prior to 2.7.26, 2.9.16, 2.11.14, 2.12.11, and 2.13.7, a kumactl profile manually configured for an HTTPS control plane without --ca-cert-file disables TLS peer verification and sends API tokens...

CVE-2026-69212: Exposure of Sensitive Information to an Unauthorized Actor

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers only when a redirect changes authority, but authority comparison excludes the URI scheme. A same-authority redirect from HTTPS to HTTP...

Astra Linux – Vulnerability in Squid

A issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, sensitive information about clients using the proxy may be exposed through an HTTPS request to an internal cache manager URL. This issue has been fixed in version 5.7...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: Security. The supported versions affected include Oracle Java SE: 8u341, 8u345-perf, 11.0.16.1; Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3, and 22.2.0. This easily exploitable...

Astra Linux – Vulnerability in Perl

CPAN.pm before version 2.35 does not verify TLS certificates when downloading distributions via HTTPS...

Astra Linux – Vulnerability in Firefox

If an attacker needed a user to load an insecure http: page and knew that the user had enabled HTTPS-only mode, the attacker could trick the user into clicking to grant an HTTPS-only exception, provided they could get the user to participate in a clicking game. This vulnerability affects Firefox...

Astra Linux – Vulnerability in busybox

Busybox contains a vulnerability related to SSL certificate validation. This vulnerability exists in the “busybox wget” applet, and it can lead to the execution of arbitrary code. This vulnerability appears to be exploitable by simply downloading any file over an HTTPS connection using “busybox...

Astra Linux – Vulnerability in openjdk-11

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition products of Oracle Java SE component: JSSE. The supported versions affected by this vulnerability include Oracle Java SE: 8u481, 8u481-b50, 8u481-perf, 11.0.30, 17.0.18, 21.0.10, 25.0.2, 26; Oracle...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-requests (UTSA-2023-002301)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002301 advisory. Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint...

CLEANSTART-2026-LE73008 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

Multiple security vulnerabilities affect the prometheus-redis-exporter package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. See references for individual vulnerability details...

PT-2026-89243

This module allows you to configure your Drupal site as a SAML 2.0 Service Provider so that users can authenticate through an external identity provider. The module does not properly validate TLS certificates when making outbound HTTPS requests. An attacker in a position to intercept network...

MOVEit Transfer - Remote Code Execution

In Progress MOVEit Transfer before 2021.0.6 13.0.6, 2021.1.4 13.1.4, 2022.0.4 14.0.4, 2022.1.5 14.1.5, and 2023.0.1 15.0.1, a SQL injection vulnerability has been found in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain access to MOVEit Transfer's database...