CVE-2026-60331

...

CVE-2026-60323

...

CVE-2026-60323

CVE-2026-60323 affects Oracle Identity Manager (OIM Legacy UI) in Oracle Fusion Middleware, with affected versions 12.2.1.4.0 and 14.1.2.1.0. The vulnerability is exploitable over HTTP by a low-privileged, network-accessible attacker, enabling unauthorized creation, deletion or modification of da...

CVE-2026-60318

...

CVE-2026-60288

CVE-2026-60288 affects Oracle Coherence (Core) within Oracle Fusion Middleware. Affected versions include 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability is described as easily exploitable with unauthenticated network access via TCP, potentially allowing takeover of Oracle C...

CVE-2026-60285

...

CVE-2026-60261

CVE-2026-60261 affects Oracle Coherence (Oracle Fusion Middleware Core). Affected versions: 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows an unauthenticated attacker with access to the hardware’s physical communication segment to compromise Coherence, potentially ta...

CVE-2026-60258

The CVE-2026-60258 entry concerns Oracle Coherence (Core) within Oracle Fusion Middleware. Affected versions are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. The vulnerability allows an unauthenticated attacker with network access via TCP to compromise Oracle Coherence, potentially taking ...

CVE-2026-60253

...

CVE-2026-60254

...

CVE-2026-60225

...

CVE-2026-60174

Technical details for CVE-2026-60174 are not publicly available in the provided documents. Monitor for updates from Oracle and CVE/NVD sources.

CVE-2026-60162

...

CVE-2026-60145

...

CVE-2026-47007

...

CVE-2026-46983

CVE-2026-46983 affects Oracle Retail Integration Bus (RIB Kernel) in Oracle Retail Applications, with affected version 16.0.3. The vulnerability is exploitable by an unauthenticated attacker with network access via HTTP, potentially enabling takeover of the Oracle Retail Integration Bus. CVSS 3.1...

CVE-2026-65316

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log...

GHSA-2FCR-JFVC-VGG2 Gitea: Two SSRF findings

| --- | --- | | Versions tested | gitea/gitea:1.26.2 digest sha256:7d13848af12645600a5f9d93ee2560daa9c6fa6b5b859b7bff3a5e1c0b661031; gitea/gitea:latest resolves to the same digest at time of writing | | Source review | git checkout v1.26.2 commit 2c749ce | | Reproduction | bash runpoc.sh single...

CVE-2026-64878

creationtimestamp| type| source ---|---|--- 2026-07-21 21:04:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6piiv7552i 2026-07-21 23:42:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6ye6zujs23 2026-08-13 08:46:35+00:00| seen|...

Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Summary The API endpoint DELETE /repos/owner/repo/issues/index/labels/id loads the label by ID with a global, unscoped lookup and never verifies the label belongs to the URL's repository or its owning organization. Because the response status differs by whether the label ID exists anywhere on the...