CVE-2026-47054

...

CVE-2026-47046

...

CVE-2026-47040

CVE-2026-47040 describes a vulnerability in the Oracle Net Services component of Oracle Database Server. Affected are 19.3–19.31, 21.3–21.22, and 23.4.0–23.26.2. An unauthenticated attacker with network access via Oracle Net can compromise Oracle Net Services, potentially leading to unauthorized ...

CVE-2026-47040

...

CVE-2026-47038

CVE-2026-47038 affects Oracle Database Server’s RDBMS component. Supported vulnerable versions: 19.3–19.31, 21.3–21.22, and 23.4.0–23.26.2. An attacker with high privileges and network access via Oracle Net can exploit this to perform unauthorized updates/inserts/deletes on some RDBMS data. CVSS ...

CVE-2026-47032

CVE-2026-47032 affects Oracle Siebel CRM End User (component: Redwood UI). Affected versions: 24.4–26.3. The issue is exploitable with network access via HTTP by a high-privilege attacker and requires user interaction; may impact additional products (scope change) and can cause a partial denial o...

CVE-2026-47028

...

CVE-2026-47028

The CVE-2026-47028 entry concerns Oracle E-Business Suite’s Document Management and Collaboration (Attachments) with affected versions 12.2.3–12.2.15. The underlying issue allows a low-privilege, network-accessible attacker (HTTP) to compromise DMC, enabling unauthorized creation, deletion, or mo...

CVE-2026-47005

...

CVE-2026-46995

CVE-2026-46995 affects Oracle Enterprise Manager Base Platform (component: Metadata Plugin) in versions 13.5 and 24.1. The vulnerability allows a low-privilege, network-accessible attacker over HTTPS to compromise the Base Platform, potentially leading to full takeover (CVSS 3.1 base score 8.8). ...

CVE-2026-46954

...

CVE-2026-65316 xxl-job Cross-Job-Group Log Disclosure via Missing Authorization Check in /joblog/logDetailCat

XXL-Job version 2.4.2 contains an insecure direct object reference vulnerability that allows authenticated users to read execution log content from job groups they are not authorized to access by supplying arbitrary sequential log IDs to the logDetailCat endpoint. Attackers can enumerate log...

CVE-2026-63918

A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol l2tp module. A race condition exists where a network session's memory could be prematurely released while still in use. This vulnerability, caused by incorrect reference counting, may allow a local attacker to trigger a system cras...

GHSA-XV9X-FJ9G-VJ6H Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Details RemoveDependency in routers/web/repo/issuedependency.go takes a removeDependencyID form parameter identifying the other issue by its global numeric ID, and fetches it with issuesmodel.GetIssueByIDctx, depID - no repository or permission check at all. It then calls...

CVE-2026-64821

The issue CVE-2026-64821 affects djangoSIGE up to version 1.10. The vulnerability arises in order-cancellation logic (CancelarOrcamentoVendaView, CancelarPedidoVendaView, CancelarOrcamentoCompraView, CancelarPedidoCompraView) implemented in HTTP GET handlers, allowing unauthenticated attackers to...

CVE-2026-47419

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The agent CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/agents/agentid gate access on requireworkspacememberworkspaceid only, then...

CVE-2026-47419 praisonai-platform: Agent endpoints accept any agent_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The agent CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/agents/agentid gate access on requireworkspacememberworkspaceid only, then...

CVE-2026-47418 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on...

CVE-2026-47418 praisonai-platform: Project endpoints accept any project_id without workspace ownership check, cross-workspace read/update/delete IDOR

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an Insecure Direct Object Reference. The project CRUD endpoints GET / PATCH / DELETE /workspaces/workspaceid/projects/projectid and GET .../projectid/stats gate access on...

CVE-2026-47418

Vulnerability: PraisonAI Platform is affected by an insecure direct object reference (IDOR) in project endpoints. The API gates access using require_workspace_member(workspace_id) but does not enforce workspace-scoped lookups for project_id. As a result, a member of one workspace (W1) can read, m...