EUVD-2026-46642

Ollama HEAD f0078ae contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafted GGUF file with attacker-controlled length and count fields in string lengths, tensor dimension counts, and metadata arra...

EUVD-2026-46485

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Metadata Plugin. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle...

EUVD-2026-46487

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Metadata Plugin. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

EUVD-2026-46486

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Metadata Plugin. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle...

EUVD-2026-46484

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Metadata Plugin. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle...

PT-2026-63397

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values...

PT-2026-63559

Name of the Vulnerable Software and Affected Versions Next.js versions 15.5.0 through 15.5.20 Next.js versions 16.0.0 through 16.2.10 Description When self-hosting with the default image loader, the Image Optimization API can optimize remotely hosted images if configured. Malicious content within...

PT-2026-63466

Name of the Vulnerable Software and Affected Versions MongoDB affected versions not specified Description An authenticated user with write privileges on a collection enabled with Queryable Encryption can modify internal encryption metadata fields that should be controlled by the server. This occu...

PT-2026-63396

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers...

PT-2026-63465

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated user can access session metadata of other users via the $listSessions aggregation stage. This data, which includes active session identifiers,...

PT-2026-63398

In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock...

PT-2026-63395

Name of the Vulnerable Software and Affected Versions Telerik UI for AJAX versions prior to 2026.2.708 Description Forged upload metadata can influence the processing of AsyncUploadTypeName, leading to unsafe attacker-controlled type resolution. This flaw allows for remote code execution in...

CVE-2026-46998

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Metadata Plugin. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

CVE-2026-46997

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Metadata Plugin. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle...

CVE-2026-46995

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Metadata Plugin. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle...

GHSA-HRXH-6V49-42GF gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine internal/xds/rbac and the HTTP/2 transport server implementation internal/transport. These vulnerabilities could result in: - Authorization Bypass Fail-Open when translating...

GHSA-2RP8-MM9Q-FP49 TypeORM: migration:generate template-literal code injection

Summary typeorm migration:generate embeds database schema metadata into JS/TS template literals, escaping backticks but not $.... An attacker who can write schema metadata column comments, defaults, view definitions achieves arbitrary code execution on the host that loads the generated migration...

Arbitrary Code Injection

Overview org.webjars.npm:typeorm is an ORM that can run in NodeJS, Browser, Cordova, PhoneGap, Ionic, React Native, NativeScript, Expo, and Electron platforms and can be used with TypeScript and JavaScript ES5, ES6, ES7, ES8. Affected versions of this package are vulnerable to Arbitrary Code...

TypeORM: migration:generate template-literal code injection

Summary typeorm migration:generate embeds database schema metadata into JS/TS template literals, escaping backticks but not $.... An attacker who can write schema metadata column comments, defaults, view definitions achieves arbitrary code execution on the host that loads the generated migration...

Server-side Request Forgery (SSRF)

Overview code.gitea.io/gitea/services/migrations is a painless self-hosted Git Service. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the Open function, which uses raw http.Get and os.Open without proper host or scheme validation. An attacker can access...