CVE-2026-21966

Consolidated details for CVE-2026-21966 show an easily exploitable vulnerability in Oracle Hospitality OPERA 5 Property Services (component: Opera) affecting versions 5.6.19.23–5.6.27.4. The issue allows an unauthenticated attacker with network access via HTTP to compromise the service, with huma...

CVE-2026-21965

...

CVE-2026-21963

CVE-2026-21963 affects Oracle VM VirtualBox core, with vulnerable versions 7.1.14 and 7.2.4. The flaw allows a high-privilege attacker who can log on to the infrastructure where VirtualBox runs to compromise the VM software, potentially leading to unauthorized access to data. The CVSS 3.1 base sc...

CVE-2026-21956

...

CVE-2026-21957

...

CVE-2026-21951

CVE-2026-21951 affects Oracle PeopleSoft Enterprise PeopleTools Integration Broker for PeopleSoft 8.60–8.62. An unauthenticated attacker with network access via HTTP can compromise the system, with attacks requiring human interaction. Impact includes unauthorized update/insert/delete and read acc...

CVE-2026-21947

...

CVE-2026-21944

...

CVE-2026-21944

The CVE-2026-21944 affects Oracle Agile Product Lifecycle Management for Process (Product Quality Management component) with affected version 6.2.4. It describes a low-privilege attacker who can exploit over HTTP network access to gain unauthorized access to data. Affected status is supported by ...

CVE-2026-21943

CVE-2026-21943 affects Oracle E-Business Suite Scripting Admin in versions 12.2.3–12.2.15. An unauthenticated attacker with network access via HTTP can compromise Oracle Scripting, with human interaction required. Impact includes unauthorized updates, inserts, deletes, and read access to Oracle S...

CVE-2026-21940

...

CVE-2026-21936

...

CVE-2026-21922

...

CVE-2026-23844

Whisper Money is a personal finance application. Versions prior to 0.1.5 have an insecure direct object reference vulnerability. A user can update/create account balances in other users' bank accounts. Version 0.1.5 fixes the issue...

EUVD-2026-3338

A flaw in Node.js’s Permissions model allows attackers to bypass --allow-fs-read and --allow-fs-write restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files...

EUVD-2026-3331

A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the vm module with the timeout option. Under specific timing conditions, buffers allocated with Buffer.alloc and other TypedArray instances like Uint8Array may contain leftover...

CVE-2025-58923

creationtimestamp| type| source ---|---|--- 2026-01-20 20:22:11+00:00| seen| Telegram/0xDArAX3HG3crsZxcgbRQEYLhb2wCsLIArjPpvex34-6k...

CVE-2026-23843

teklifolusturapp is a web-based PHP application that allows users to create, manage, and track quotes for their clients. Prior to commit dd082a134a225b8dcd401b6224eead4fb183ea1c, an Insecure Direct Object Reference IDOR vulnerability exists in the offer view functionality. Authenticated users can...

EUVD-2026-3353

NVIDIA Nsight Systems for Linux contains a vulnerability in the .run installer, where an attacker could cause an OS command injection by supplying a malicious string to the installation path. A successful exploit of this vulnerability might lead to escalation of privileges, code execution, data...

External Secrets Operator insecurely retrieves secrets through the getSecretKey templating function

Summary The getSecretKey template function, while introduced for senhasegura Devops Secrets Management DSM provider, has the ability to fetch secrets cross-namespaces with the roleBinding of the external-secrets controller, bypassing our security mechanisms. This function was completely removed, ...