Imperative Web Server Oracle Helidon Library Data Access DoS

The vulnerability of the Imperative Web Server component of the Oracle libraries in the Oracle Fusion Middleware software suite is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain access to add, delete, modify, and read data, as well as to...

Imperative Web Server Oracle Helidon Privilege Escalation

The vulnerability of the Imperative Web Server component of the Oracle libraries in the Oracle Fusion Middleware software suite is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain access to add, delete, modify, and read data...

Imperative Web Server Oracle Helidon Library Data Access DoS

The vulnerability of the Imperative Web Server component of the Oracle Helidon library in the Oracle Fusion Middleware software platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain access to add, delete, modify, and read data, as wel...

Imperative Web Server Oracle Helidon Library Data Access DoS

The vulnerability of the Imperative Web Server component of the Oracle Helidon library in the Oracle Fusion Middleware software platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain access to add, delete, modify, and read data, as wel...

Imperative Web Server Oracle Helidon Library Data Access DoS

The vulnerability of the Imperative Web Server component of the Oracle Helidon library in the Oracle Fusion Middleware software platform is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain access to add, delete, modify, and read data, as wel...

PT-2026-82495

The ‘/ws/apitribuna/setVisita’ endpoint is vulnerable to SQL injection through the id video and id ambito parameters. The application does not validate or sanitize these inputs before including them in SQL queries. This allows a remote attacker to inject SQL syntax and disrupt the execution of...

EUVD-2026-67265

Veno File Manager Project 4.4.9 is vulnerable to Arbitrary File Deletion in /vfm-admin/index.php?section=translations&action=update&remove=...

PT-2026-82428

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout total when the BOGO...

PT-2026-82554

Name of the Vulnerable Software and Affected Versions Eclipse SW360 versions 19.0.0 through 20.1.0 Description When the system is configured to use file system storage via the enable.attachment.store.to.file.system config key, an attacker can manipulate the filename during upload. This allows for...

ROS-20260827-73-0009

The vulnerability of the qla24xxissuesareplaceiocb function in the drivers/scsi/qla2xxx/qlaedif.c module of the SCSI device driver for the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-82448

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.12.0 through 3.17.0 Description An inconsistent interpretation of HTTP requests, known as HTTP Request/Response Smuggling, occurs on serverless-plugin routes. This allows an attacker to manipulate the request stream so...

CVE-2026-81421 ddfourtwo sentry-selfhosted-mcp raw_sentry_api server-side request forgery

A security flaw has been discovered in ddfourtwo sentry-selfhosted-mcp 0.4.0. The affected element is an unknown function of the component rawsentryapi. The manipulation of the argument endpoint results in server-side request forgery. It is possible to launch the attack remotely. The exploit has...

CVE-2025-70340

A Broken Access Control vulnerability exists in ThingsBoard Professional Edition PE 4.21 and below, within the Alarms comments functionality. An authenticated customer user can manipulate the respective API request parameters to create or modify system-generated alarm comments. This allows...

CVE-2026-73479

A flaw was found in dua-cli. This vulnerability allows attackers to craft malicious file names containing terminal escape sequences, specifically Operating System Command OSC or Control Sequence Introducer CSI sequences. When these marked file paths are printed after exiting the Text-based User...

CVE-2026-81032 NebulaGraph through 3.8.0 Unauthenticated Read and Modification of Runtime Configuration

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. Each daemon starts the web service defined in src/webservice/WebService.cpp, whose bind address defaults to all interfaces, and registers routes for reading and writing gflags alongside status and statistics...

CVE-2026-19271

Improper Neutralization of Special Elements used in an LDAP Query 'LDAP Injection' vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows LDAP Injection. This issue affects Liderahenk: from 3.4.0 before 3.5.5...

WordPress Appointment Hour Booking plugin < 1.5.88 - Unauthenticated Booking Price Manipulation via tcost Parameter vulnerability

Unauthenticated Booking Price Manipulation via tcost Parameter vulnerability discovered by Researcher1: Alessandro Greco aka Aleff; Researcher2: Giovambattista Ianni; Company/Organization: University of Calabria UNICAL in WordPress Plugin Appointment Hour Booking versions 1.5.88...

CVE-2026-79619

On Linux, several OpenZFS ioctl authorization checks accept a capability held only within a user-created, unprivileged namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrativ...

CVE-2026-77789

The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to the requesting customer-portal session before acting on it, allowing a user with a confirmed portal session to cancel, reactivate or modify subscriptions...

CVE-2026-16986

The Booking Package WordPress plugin before 1.7.25 does not validate the payment amount server-side against the stored service price, deriving the expected charge from attacker-supplied request values instead, so an unauthenticated attacker can pay an arbitrary fraction of a service's real price...