CVE-2026-16421

Inappropriate implementation in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-60899

Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite component: Rapid Implementation. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HC...

CVE-2026-60900

Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite component: Rapid Implementation. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle H...

CVE-2026-59140 Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths

Data::SortedSet::Shared versions before 0.03 for Perl allow an out-of-bounds read via unvalidated node indices in the rank and min/max query paths. The attach-time validator ssvalidateheader bounds only the root index against the node pool nodecapacity. The order-statistics and min/max queries th...

CVE-2026-16243 Eclipse OMR : arraycmp SIMD implementation does not check if the number of bytes to compare is zero

In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero...

[SECURITY] Fedora 44 Update: libreswan-5.3.2-2.fc44

Libreswan is a free implementation of IPsec & IKE for Linux. IPsec is the Internet Protocol Security and uses strong cryptography to provide both authentication and encryption services. These services allow you to build secure tunnels through untrusted networks. Everything passing through the...

CVE-2026-60899: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite component: Rapid Implementation. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HC...

CVE-2026-60900: Improper Privilege Management

Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite component: Rapid Implementation. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle H...

PT-2026-62851

Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite component: Rapid Implementation. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HC...

The vulnerability of the Get() function in the ZenLib::BitStream_LE::Get() function from the file ZenLib/Source/ZenLib/BitStream_LE.h, a data reading library, allows a malicious actor to cause a service failure.

The vulnerability of the ZenLib::BitStreamLE::Get function in the ZenLib/Source/ZenLib/BitStreamLE.h header file of the MediaInfo reading library is related to dependencies that are undefined for each implementation type. Exploiting this vulnerability could allow an attacker to cause a service...

CVE-2026-64608: Access of Resource Using Incompatible Type

Heap type confusion and out-of-bounds read/write in the Apache Fory C++ implementation. When deserializing data in compatible mode, the field-skip paths do not correctly validate the declared field types against the actual data, so input with an inconsistent schema can cause type confusion and...

CVE-2026-64036

In the Linux kernel, the following vulnerability has been resolved: cgroup/rstat: validate cpu before cssrstatcpu access cssrstatupdated is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a...

CVE-2026-49485

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.9 and 6.9.4.2, all implementations of FHIRPathEngine accept arbitrary FHIRPath expressions and evaluate them without input validation, and the FHIRPath functions matches,...

CVE-2026-54465

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.1, when websocket-driver is used to implement a WebSocket server on top of a TCP server using WebSocket::Driver.server or to complement a WebSocket client, a peer can make a single connection consume an unbounded...

UBUNTU-CVE-2026-48487

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.16, readcharacterstring and readstring in src/zeroconf/protocol/incoming.py advanced self.offset by attacker-declared RDLENGTH without checking it against self.datalen, allowing unauthenticated hosts on th...

CVE-2026-47180

Zeroconf is a pure Python implementation of multicast DNS service discovery. Prior to 0.149.5, DNSIncoming.decodelabelsatoffset recurses once per DNS-name compression pointer, and a single mDNS packet carrying chained pointers can trigger a RecursionError that escapes DNSIncoming.init, causing...

CVE-2026-54496 Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action circuit soundness

ZEBRA is a Zcash node written entirely in Rust. Prior to zebrad 5.0.0, halo2gadgets 0.5.0, orchard 0.14.0, zcashprimitives 0.28.0, and zcashd 6.20.0, the variable-base scalar multiplication gadget in halo2gadgets/src/ecc/chip/mul/incomplete.rs used assignadvice for the base point without a copy...

AI Can Find Bugs, But Human Knowledge Still Proves Them

Artificial intelligence AI is changing offensive security, but it has not changed the standard that matters most: a finding has to be proven before it becomes useful. AI-assisted tools can read code quickly, generate payloads, summarize attack surfaces, explain unfamiliar APIs, and run repetitive...

PT-2026-60601

Name of the Vulnerable Software and Affected Versions Quicly versions prior to commit 937d0e9 Description An assertion failure occurs when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB. This leads to a Denial of Service,...

PT-2026-60502

Name of the Vulnerable Software and Affected Versions Buffa versions prior to 0.7.0 Description A soundness bug in the OwnedView type allows safe Rust code to trigger a use-after-free. The OwnedView::decode constructor transmutes a borrowed slice to &'static u8, and the Deref implementation expos...