EUVD-2026-74187

OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS...

CVE-2026-27553 Information Disclosure via Schema Path Manipulation

A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnosticstab/ajaxdiagtablerows endpoint using a valid user cookie allowing disclosure of all user password hashes...

CVE-2026-27553 Information Disclosure via Schema Path Manipulation

A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnosticstab/ajaxdiagtablerows endpoint using a valid user cookie allowing disclosure of all user password hashes...

CVE-2026-92220

A flaw was found in vllm-project vLLM. A remote attacker can exploit this vulnerability by manipulating specific arguments within the MoRIIO Acknowledgement Handler component. This manipulation can lead to excessive resource consumption, potentially impacting the availability of the system...

CVE-2026-92217

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This affects the function processMessages of the file renderers/webcore/src/v09/processing/message-processor.ts of the component Message Parsing. This manipulation causes dynamically-determined object attributes. The attack can be...

kernel: Linux kernel: Arbitrary code execution via userfaultfd shadow stack manipulation

A flaw was found in the Linux kernel's userfaultfd mechanism. A local attacker with userfaultfd access could register on shadow stack Virtual Memory Areas VMAs. By discarding a page and injecting a page with chosen return addresses, an attacker could achieve arbitrary code execution. This...

CVE-2026-92213

a2ui-project a2ui (versions up to 0.10.6) is affected by an injection vulnerability in the Angular Renderer component. The vulnerable code is located in the function z.any within the file renderers/web_core/src/v0_9/schema/server-to-client.ts. By manipulating the primaryColor argument, a remote a...

CVE-2026-87976: Improper Limitation of a Pathname to a Restricted Directory

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...

PT-2026-93747

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description The djust.mixins.model binding.ModelBindingMixin provides a default update model event handler that allows a client to set any public, existing view attribute via a WebSocket request using the paramete...

PT-2026-93285

The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards, allowing unauthenticated users to replace a paid ticket with a free one and complete the order at no charge...

PT-2026-94010

Name of the Vulnerable Software and Affected Versions Cisco ISE affected versions not specified Description An issue exists in the endpoint posture status reporting functionality of the guest portal web application. This is caused by insufficient authentication on an internal interface exposed...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38566)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the setWiFiAdvancedCfg function. Attackers can exploit this vulnerability by sending a specially crafted...

The vulnerability of the WebLogic Server Proxy Plug-In for third-party web servers within the Oracle Fusion Middleware software platform allows a malicious individual to gain unauthorized access to create, delete, or modify data.

The vulnerability of the WebLogic Server Proxy Plug-In for third-party web servers within the Oracle Fusion Middleware software platform is related to access control errors. Exploiting this vulnerability could allow an attacker to gain unauthorized access to create, delete, or modify data using t...

The vulnerability of the CMP module in the OpenSSL library, which allows a hacker to trigger a service failure

The vulnerability of the CMP module in the OpenSSL library is related to the pointer manipulation during the processing of the protectionAlg parameter. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the ci parameter in the GET request, which is passed to the unserialize function without restricting allowed classes. An attacker can execute arbitrary code or manipulate the database by supplying a...

CVE-2026-15640

CVE-2026-15640 affects Delinea Secret Server , a secrets management product. Under certain conditions, a valid SAML Identity Provider (IdP) response can be manipulated to impersonate another Secret Server user , effectively bypassing authentication. The vulnerability is rated CVSS 4.0: 9.5 (Criti...

CVE-2026-87153

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub...

CVE-2026-83428

Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Demand...

CVE-2026-83307

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: BI Platform Security. Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle B...

CVE-2026-83027

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attach...