CVE-2026-21577

This CVE affects Confluence Data Center, introduced in versions 9.0.1–10.2.0. It is a High severity DoS (CVSS 7.1) that an authenticated attacker can use to make a resource unavailable by disrupting network-connected services. Upgrades are recommended: move to Confluence Data Center 9.2.17 or new...

CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

PT-2026-62634

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft Enterprise FIN eSettlements version 9.2 Description A flaw in the eSettlements component allows a high-privileged attacker with access to the infrastructure where the software executes to compromise the system. This can lead ...

PT-2026-62640

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft PeopleSoft Enterprise CS Student Financials version 9.2.38 Description A flaw in the Billing component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead t...

PT-2026-62666

Name of the Vulnerable Software and Affected Versions Oracle JD Edwards EnterpriseOne Tools version 9.2.26.3 Description An issue exists in the Installation Security component that allows an unauthenticated attacker with access to the physical communication segment attached to the hardware to...

PT-2026-63104

Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Switzerland product of Oracle PeopleSoft component: Global Payroll for Switzerland. The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to...

PT-2026-62557

Name of the Vulnerable Software and Affected Versions Oracle JD Edwards EnterpriseOne Solution Advisor version 9.2 Description A flaw in the Solution Advisor component allows a low-privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a...

CVE-2026-58229

Allocation of resources without limits vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the client host and cause a denial of service. The Mint.HTTP1.decodeheaders/5 and Mint.HTTP1.decodetrailerheaders/4 functions in lib/mint/http1.ex accumulate every parsed...

BIT-NEXTCLOUD-2023-49790 App PIN code can be bypassed in Nextcloud Files iOS

The Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform. Prior to version 4.9.2, the application can be used without providing the 4 digit PIN code. Nextcloud iOS Files app should be upgraded to 4.9.2 to receive the patch. No known workaroun...

Information Disclosure axios Dependency in Confluence Data Center

This High severity Information Disclosure vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0, and 10.2.0 of Confluence Data Center. This Information Disclosure vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.2.2 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification vulnerability

Missing Authorization to Unauthenticated Arbitrary Form Entry Modification vulnerability discovered by Michael Iden Mickhat in WordPress Plugin NEX-Forms versions = 9.2.2...

DoS (Denial of Service) in Confluence Data Center

This High severity DoS Denial of Service vulnerability was introduced in versions 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center. This DoS Denial of Service vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to cause a resource...

PYSEC-2026-1641 mlflow vulnerable to Path Traversal

A path traversal vulnerability exists in the mlflow/mlflow repository, specifically within the artifact deletion functionality. Attackers can bypass path validation by exploiting the double decoding process in the deleteartifactmlflowartifacts handler and localfileuritopath function, allowing for...

Important: Red Hat Security Advisory: kernel-rt security update

An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-57351

Unauthenticated Cross Site Scripting XSS in HandL UTM Grabber = 2.9.2 versions...

CVE-2026-12142

CVE-2026-12142 affects the NEX-Forms – Ultimate Forms Plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting (XSS) via the internal parameter named '_name[]' , present in all versions up to and including 9.2.2 . Root cause: insufficient input sanitization and output escaping, co...

CVE-2026-55693 affecting package vim for versions less than 9.2.0735-1

CVE-2026-55693 affecting package vim for versions less than 9.2.0735-1. An upgraded version of the package is available that resolves this issue...

PYSEC-2026-451 pgAdmin 4 Vulnerable to Remote Code Execution

Remote Code Execution security vulnerability in pgAdmin 4 Query Tool and Cloud Deployment modules. The vulnerability is associated with the 2 POST endpoints; /sqleditor/querytool/download, where the querycommited parameter and /cloud/deploy endpoint, where the highavailability parameter is unsafe...

EUVD-2026-39705

Unauthenticated Cross Site Scripting XSS in Blog2Social = 8.9.2 versions...

CVE-2026-57455

Vim (open source editor) prior to version 9.2.0698 is affected by a stack out-of-bounds write in spell_soundfold_sofo() (src/spell.c). The single-byte branch translates a word through a SOFO byte map into a caller-owned result buffer; the copy loop advances the output index with no upper bound an...