CVE-2026-47688 FOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the clearAES and clearPMTasks methods in FOGPage can be invoked by an unauthenticated attacker via a single HTTP GET request through the public client node...

CVE-2026-47685 FOGProject has stored XSS via unauthenticated inventory service renders unescaped in Host Management page

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint /service/inventory.php persists client-supplied values without sanitization, and the Host Management Inventory page...

EUVD-2026-46413

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the unauthenticated inventory service endpoint /service/inventory.php persists client-supplied values without sanitization, and the Host Management Inventory page...

harambe-sdk (>=0.32.0, <=0.53.0), project-lighter (>=0.0.3a4, <=0.0.3a8) potentially affected by CVE-2026-59890 via setuptools (73.0.0)

setuptools PYPI version 73.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - harambe-sdk =0.32.0, =0.0.3a4, =0.0.3a8 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...

CVE-2026-47418

Vulnerability: PraisonAI Platform is affected by an insecure direct object reference (IDOR) in project endpoints. The API gates access using require_workspace_member(workspace_id) but does not enforce workspace-scoped lookups for project_id. As a result, a member of one workspace (W1) can read, m...

CVE-2026-47418 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on...

CVE-2026-47418 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on...

CVE-2026-47418 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on...

CVE-2026-47418

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on...

[SECURITY] Fedora 43 Update: freerdp-3.30.0-1.fc43

The xfreerdp & wlfreerdp Remote Desktop Protocol RDP clients from the FreeR DP project. xfreerdp & wlfreerdp can connect to RDP servers such as Microsoft Windows machines, xrdp and VirtualBox...

[SECURITY] Fedora 43 Update: c-ares-1.34.8-1.fc43

c-ares is a C library that performs DNS requests and name resolves asynchronously. c-ares is a fork of the library named 'ares', written by Greg Hudson at MIT...

PT-2026-62905

Name of the Vulnerable Software and Affected Versions Oracle Project Portfolio Analysis versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Project Portfolio Analysis product within Oracle E-Business Suite. A low privileged attacker with...

CVE-2026-60984: Improper Access Control

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

PT-2026-62824

Name of the Vulnerable Software and Affected Versions Oracle Project Contracts versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Project Contracts product within Oracle E-Business Suite. A low privileged attacker with network access via...

PT-2026-62904

Name of the Vulnerable Software and Affected Versions Oracle Project Portfolio Analysis versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Project Portfolio Analysis product of Oracle E-Business Suite. A low privileged attacker with...

CVE-2026-61209: Improper Privilege Management

Vulnerability in the PeopleSoft In-Memory Project Discovery product of Oracle PeopleSoft component: Project Discovery. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft In-Memory...

PT-2026-62878

Name of the Vulnerable Software and Affected Versions Oracle Project Contracts versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can result in...

CVE-2026-62483: Improper Access Control

Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project...

PT-2026-62906

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-60985: Improper Access Control

Vulnerability in the Oracle Project Portfolio Analysis product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...