CVE-2026-70714: Improper Access Control

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Hyperion Calculation...

PT-2026-77825

Name of the Vulnerable Software and Affected Versions Oracle Process Manufacturing Systems versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can le...

PT-2026-78162

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon version 3.2.18 Description A flaw in the Imperative Web Server component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized...

PT-2026-77555

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 Description A flaw in the Common Security component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to...

PT-2026-77531

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM Siebel CRM Cloud Applications versions 22.3 through 26.6 Description A flaw in the Siebel Cloud Manager component allows a high privileged attacker with network access via HTTP to compromise the system. This issue can lead to...

PT-2026-77446

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 14.1.2.0.0 Oracle WebCenter Content version 12.2.1.4.0 Description A flaw in the Content Server component of Oracle Fusion Middleware allows a low privileged attacker with network access via HTTP to compromise...

PT-2026-77896

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Data Relationship Management version 11.2.25.0.000 Description A flaw in the Access and security component allows a low privileged attacker with network access via HTTPS to compromise the system. The exploitation requires human...

PT-2026-77563

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion component: Common Events. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion...

GitLab 18.2 < 18.11.11 / 19.0 < 19.0.8 / 19.1 < 19.1.6 / 19.2 < 19.2.4 (CVE-2026-19478)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allo...

Missing Authorization

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Missing Authorization via the LogInputs and LogOutputs endpoints,...

CVE-2026-19589

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability CVE-2026-19589 is fixed in...

AZL-96603 CVE-2026-19589 affecting package packer for versions less than 1.9.5-20

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability CVE-2026-19589 is fixed in...

EUVD-2026-60378

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability CVE-2026-19589 is fixed in...

CVE-2026-19589

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability CVE-2026-19589 is fixed in...

CVE-2026-71858

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++...

CVE-2026-19478

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

CVE-2026-71858

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++...

CVE-2026-71858

Notepad++ prior to 8.9.7 is vulnerable to an HMAC bypass in its macro system. Macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation normally applied to UserDefinedCommands, allowing invocation of Scintilla actions and the internal Open in Default Viewer command within...

CVE-2026-19478

GitLab CE/EE (self-managed) versions 18.2 through 19.2.3 are affected by a critical unauthenticated arbitrary method invocation vulnerability (CVSS 9.4, CWE-94) in the GraphQL API. The root cause is in the @gl_introduced directive's fallback field resolver (future_field_fallback.rb), which calls ...

CVE-2026-19478 Improper Control of Generation of Code ('Code Injection') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...