CVE-2026-83162

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Core. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Application...

CVE-2026-83163

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Attachments / File Upload. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...

EUVD-2026-79536

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Core. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Obje...

CVE-2026-83184

Oracle Application Object Library (component: Core) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 contains a vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise the component. The vulnerability is rated difficult to exploit (high attack co...

EUVD-2026-79530

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Core. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Application Obje...

CVE-2026-83178

CVE-2026-83178 affects the Oracle Application Object Library (component: Core ) in Oracle E-Business Suite , versions 12.2.3 through 12.2.15 . The vulnerability allows a high-privileged attacker with network access via HTTP to compromise the product, resulting in takeover of the Oracle Applicatio...

CVE-2026-83175

Oracle Application Object Library (AAL) , component Core within Oracle E-Business Suite , is vulnerable in supported versions 12.2.3 through 12.2.15 . A low-privileged attacker with network access via HTTP can exploit this vulnerability with low complexity to achieve unauthorized access to critic...

EUVD-2026-79494

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Core. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object...

CVE-2026-83167

Oracle Application Object Library (component: Core) in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is affected by an unauthenticated vulnerability exploitable over HTTP . An attacker with network access can gain unauthorized access to critical data or complete access to all AOL-access...

CVE-2026-83163

CVE-2026-83163 affects the Oracle Application Object Library component of Oracle E-Business Suite , specifically the Attachments / File Upload module, in supported versions 12.2.3 through 12.2.15 . The vulnerability is described as easily exploitable by a low-privileged attacker with network acce...

CVE-2026-83162

Oracle Application Object Library (component: Core) in Oracle E-Business Suite versions 12.2.3–12.2.15 is affected by a vulnerability allowing an unauthenticated attacker with network access via HTTPS to achieve unauthorized creation, deletion, modification, and access to critical data. The attac...

EUVD-2026-79489

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Core. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Application...

EUVD-2026-79490

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Attachments / File Upload. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...

bypass_disablefunc_via_LD_PRELOAD

bypassdisablefunc.php有三个GET选项：cmd，outpath和sopath。 选项非常简单， cmd是你的邪恶命令， outpath是命令输出文件路径（可读和可写）， sopath是我们的共享对象bypassdisablefuncx64.so的绝对路径。例如： http://site.com/bypassdisablefunc.php?cmd=pwd&outpath=/tmp/xx&sopath=/var/www/bypassdisablefuncx64.so 一是cmd参数，待执行的系统命令（如pwd）; 二是outpath参数，保存命令执行输出结果的文件路径（如...

CVE-2026-68530 Concrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other Boards' Instances

Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details single-page controller resolved a board instance directly from an attacker-supplied instance ID and then viewed, refreshed, regenerated, ...

CVE-2026-92176 pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability

pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must...

CVE-2023-26136

Research on the vulnerability CVE-2023-26136 Description Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which objects are...

CVE-2026-54050

Sakai (a Collaboration and Learning Environment) has an IDOR in its REST API: the DELETE /api/users/{userId}/profile/image endpoint in ProfileController.removeProfileImage() passes the attacker-controlled userId to the service layer without verifying ownership, allowing any authenticated user to ...

EUVD-2026-78655

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...

CVE-2026-91984 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position

Vikunja before 2.6.0 fails to validate that user-supplied projectviewid in task-position requests belongs to the task's project. Authenticated attackers can insert task position rows into arbitrary other tenant project views via POST or PUT task-position endpoints...