SUSE CVE-2026-69240

Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not escape quotes if the value starts with TOTIMESTAMP or TODATE. In the Oracle dialect, when val is a string and starts wit...

ALPINE-CVE-2026-34191

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Portable Runtime Utility via aprdbdoracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3...

UBUNTU-CVE-2026-34191

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Portable Runtime Utility via aprdbdoracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3...

CVE-2026-34191

The Apache Portable Runtime Utility (affected versions 1.6.0 through 1.6.3) is vulnerable to an SQL Injection flaw within the apr_dbd_oracle provider. The vulnerability is caused by the improper neutralization of special elements used in an SQL command. This issue has been addressed in various di...

CVE-2026-34191 Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Portable Runtime Utility via aprdbdoracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3...

EUVD-2026-53918

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Portable Runtime Utility via aprdbdoracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3...

CVE-2026-34191 Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Portable Runtime Utility via aprdbdoracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3...

CVE-2026-69240

A flaw was found in Sequelize. When configured to use an Oracle database, the Sequelize Node.js Object-Relational Mapper ORM tool fails to properly escape certain date and timestamp values. This oversight allows a remote attacker to bypass security filters. By injecting malicious SQL commands, an...

Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access

Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk. They fed Java source code to the database, let Oracle compile it into stored schema objects, an...

Security Bulletin: Oracle Outside In Technology (OIT) v8.5.8 BP3 vulnerabilities CVE-2026-25646 (vulnerable), CVE-2026-25210 (vulnerable), CVE-2026-22184, CVE-2025-68431(affected, not vulnerable) in FileNet Content Manager (FNCM) Content

Summary Oracle Outside In Technology OIT v8.5.8 BP3 January, 2026 vulnerabilities CVE-2026-25646 vulnerable, CVE-2026-25210 vulnerable, CVE-2026-22184, CVE-2025-68431affected, not vulnerable in FileNet Content Manager FNCM Content Based Retrieval CBR content indexing Vulnerability Details...

kernel security, bug fix, and enhancement update

6.12.0-211.34.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

glibc security update

2.28-251.0.4.40 - Forward port of Oracle patches Reviewed-by: David Faust Oracle history: July-13-2026 Cupertino Miranda - 2.28-251.0.4.38 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi May-26-2026 Cupertino Miranda - 2.28-251.0.4.37 - Forward port of Oracle patches Reviewed-by:...

Oracle Linux 8 : kernel (ELSA-2026-49857)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-49857 advisory. - ipc: limit nextid allocation to the valid ID range Rafael Aquini RHEL-188216 CVE-2026-52923 Tenable has extracted the preceding description block directly fr...

Oracle Linux 9 : gimp (ELSA-2026-50817)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-50817 advisory. - fix CVE-2026-42169 - fix CVE-2026-66758 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

Oracle Linux 10 : gpsd (ELSA-2026-51075)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-51075 advisory. 3.26.1-3.0.1.el102.1 - Replace upstream reference Orabug: 37033219 1:3.26.1-3.el102.1 - fix command injection in gpsprof CVE-2026-58459 Tenable has extracted...

TencentOS Server 3: java-1.8.0-openjdk (TSSA-2026:0809)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0809 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Oracle Linux 9 : osbuild-composer (ELSA-2026-22714)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-22714 advisory. 175-1.0.1 - Track github upstream Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

kernel security, bug fix, and enhancement update

6.12.0-211.43.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

PT-2026-68521

Name of the Vulnerable Software and Affected Versions Apache Portable Runtime Utility versions 1.6.0 through 1.6.3 Description An SQL Injection issue exists in the apr dbd oracle provider. This occurs due to the improper neutralization of special elements used in an SQL command, which could allow...

kernel security, bug fix, and enhancement update

4.18.0-553.153.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...