PT-2026-93872

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

PT-2026-93401

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-fab versions prior to 3.9.0 Description Resetting a user password fails to delete existing database-backed sessions when using the FAB auth manager with fab session backend=database. This occurs because the cleanup...

CVE-2026-16794: Missing Authorization

GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an authenticated user with the Security Manager role to execute arbitrary CI/CD jobs and access protected...

Oracle Access Manager Authentication Engine Full Control

The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain full control over the application through the HTTP...

Oracle Access Manager Authentication Engine Full Control

The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain full control over the system using the HTTP network protocol...

Oracle Access Manager Authentication Engine Full Control

The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full control over the application using...

Target Management Oracle Enterprise Manager Compromise

The vulnerability of the Target Management component of the Oracle Enterprise Manager Base Platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to compromise the system using the HTTPS protocol...

Oracle Enterprise Manager Base Platform DoS

The vulnerability of the Agent Next Gen component of the Oracle Enterprise Manager Base Platform software platform is related to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause service interruptions using the HTTP network protocol...

Oracle Enterprise Manager Discovery Framework Full Control

The vulnerability of the Discovery Framework component of the Oracle Enterprise Manager Base Platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to gain full control over the application using the HTTPS protocol...

Oracle Enterprise Manager Install DoS

The vulnerability of the Install component of the Oracle Enterprise Manager Base Platform is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to cause service interruptions using the HTTPS protocol...

Oracle Identity Manager Legacy UI Access Manipulation

The vulnerability of the OIM Legacy UI component of the Oracle Identity Manager software platform in Oracle Fusion Middleware is related to insecure management of privileges. Exploiting this vulnerability could allow an attacker, operating remotely, to create, delete, or alter access to critical...

Oracle Identity Manager Legacy UI Full Control

The vulnerability of the OIM Legacy UI controller component and the Oracle Identity Manager software platform within Oracle Fusion Middleware is related to the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full...

Oracle Access Manager Authentication Engine Full Control

The vulnerability of the Authentication Engine component in the Oracle Access Manager access control system is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain full control over the system using the HTTP network protocol...

Linux Distros Unpatched Vulnerability : CVE-2026-91841

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by injecting a newline...

Linux Distros Unpatched Vulnerability : CVE-2026-91838

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special...

Linux Distros Unpatched Vulnerability : CVE-2026-91840

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a newline character in...

CVE-2026-89328: Improper Access Control

The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing several board-management operations, checking only board membership. This allows any member of a board to carry out manager-only actions on it, including adding or...

CVE-2026-76186: Reliance on Cookies without Validation and Integrity Checking

Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two...

CVE-2026-11984: Missing Authorization

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a missing capability check on the ai-debug-code URL-parameter. This makes it possible for unauthenticated attackers to view...

RHEL 10 / 9 : Red Hat Edge Manager Version 1.2.1 Security Update (Important) (RHSA-2026:68335)

The remote Redhat Enterprise Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:68335 advisory. Red Hat Edge Manager RHEM provides simple, scalable, and security-focused management of edge devices and applications. It supports...