CVE-2026-47056

...

CVE-2026-47046

CVE-2026-47046 affects Oracle Database Server, specifically the RDBMS component, with affected versions 23.4.0–23.26.2. An unauthenticated attacker can exploit this via Oracle Net to compromise the RDBMS, potentially causing a hang or crash (DoS) and unauthorized updates/inserts/deletes on access...

CVE-2026-47030

CVE-2026-47030 affects Oracle Java SE (JavaFX) with an impacted version of 8u491. The vulnerability is described as affecting client deployments that load untrusted code in sandboxed Java Web Start/applets, allowing a network-based, unauthenticated attacker to cause unauthorized updates or deleti...

CVE-2026-47003

CVE-2026-47003 affects Oracle Enterprise Manager Base Platform, specifically the UI Framework. Affected versions are 13.5 and 24.1. The vulnerability is exploitable over a network via HTTPS by an unauthenticated attacker, potentially leading to unauthorized access to critical data or the entire s...

CVE-2026-46984

...

CVE-2026-46983

...

CVE-2026-46981

The CVE-2026-46981 entry affects Oracle Utilities Network Management System (Mobile component) with affected versions 2.5.0.1.0–2.5.0.1.17, 2.5.0.2.0–2.5.0.2.11, 2.6.0.1.0–2.6.0.1.12, 2.6.0.2.0–2.6.0.2.8, and 25.12.0.0.0–25.12.0.0.2. It is an unauthenticated, network-accessible vulnerability expl...

CVE-2026-46983

CVE-2026-46983 affects Oracle Retail Integration Bus (RIB Kernel) in Oracle Retail Applications, with affected version 16.0.3. The vulnerability is exploitable by an unauthenticated attacker with network access via HTTP, potentially enabling takeover of the Oracle Retail Integration Bus. CVSS 3.1...

CVE-2026-46975

Technical details about CVE-2026-46975 are not publicly available in the provided documents. Monitor the Oracle July 2026 CPU advisory for patched versions and exact vulnerable components.

GHSA-PGQF-926R-548M Gitea: Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API

Summary The API endpoint DELETE /repos/owner/repo/issues/index/labels/id loads the label by ID with a global, unscoped lookup and never verifies the label belongs to the URL's repository or its owning organization. Because the response status differs by whether the label ID exists anywhere on the...

GHSA-XV9X-FJ9G-VJ6H Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Details RemoveDependency in routers/web/repo/issuedependency.go takes a removeDependencyID form parameter identifying the other issue by its global numeric ID, and fetches it with issuesmodel.GetIssueByIDctx, depID - no repository or permission check at all. It then calls...

Gitea: Cross-repository issue/comment attachment re-linking can expose private attachment content

Summary Gitea's issue and comment attachment update paths accept attachment UUIDs without verifying that each attachment belongs to the target issue/comment repository. If an authenticated attacker knows a victim attachment UUID, they can re-link that attachment to an attacker-controlled issue or...

DEBIAN-CVE-2026-56852

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes...

GHSA-QF2F-QH6P-7V89 Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`

Summary CVE-2026-20800 fixed private-info leakage to revoked users only for the notification endpoint. Two sibling endpoints that return data keyed on the caller's own relationship still do not re-check repo access at output time: - GET /api/v1/user/starred — getStarredRepos computes a per-repo...

Gitea CVE-2026-20800 sibling endpoints not covered: revoked user still reads private repo objects via `/api/v1/user/starred` and private issue titles via `/api/v1/user/times`

Summary CVE-2026-20800 fixed private-info leakage to revoked users only for the notification endpoint. Two sibling endpoints that return data keyed on the caller's own relationship still do not re-check repo access at output time: - GET /api/v1/user/starred — getStarredRepos computes a per-repo...

MINI-97P6-4MH6-G7MQ

Bulletin has no description...

CVE-2026-46600 Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

CVE-2026-12547

SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority host:port. When the proxy configuration changes e.g., via system settings or WPAD, cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials...

EUVD-2026-42321

linkify-it: Quadratic-complexity DoS via the mailto: validator scan-loop on attacker text...

SUSE-SU-2026:3169-1 Security update for openexr

This update for openexr fixes the following issues - CVE-2026-54920: unchecked integer overflows in Image::resize followed by an exception can lead to an invalid delete via uninitialized pointers bsc1269703. - CVE-2026-55059: row setter utilizing dataWindow.min.x instead of min.y can lead to a he...