Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the sanitization process when SVG reference elements such as or are included in the overridden allowed tags. An attacker can execute arbitrary scripts or load external resources by crafting SVG elements with...

GHSA-9WJQ-CP2P-HRGF Loofah: SVG `href` attribute bypasses local-reference restriction

Summary Loofah's HTML5 sanitizer restricted only the xlink:href attribute on certain SVG elements to local, same-document references. Browsers also accept a plain href attribute as an alternative to the deprecated xlink:href per the SVG 2 spec, but Loofah did not apply the same restriction to it,...

CVE-2026-62524

...

CVE-2026-62489

...

CVE-2026-62478

CVE-2026-62478 affects Oracle E-Business Suite’s Oracle Public Sector Financials (Internal Operations) with affected versions 12.2.3–12.2.15. The vulnerability allows a low-privileged attacker with network access over HTTP to compromise the system, potentially taking over Oracle Public Sector Fin...

CVE-2026-62456

Summary (MODE C): The CVE-2026-62456 affects Oracle E-Business Suite, Oracle HRMS (UK) – Internal Operations. Affected versions are 12.2.3–12.2.15. The vulnerability allows a low-privileged attacker with network access over HTTPS to compromise Oracle HRMS (UK), potentially leading to unauthorized...

CVE-2026-61279

CVE-2026-61279 affects Oracle E-Business Suite Proposals (component: Proposals). Affected versions are 12.2.3 through 12.2.15. The vulnerability allows a low-privileged attacker with network access via HTTP to compromise Oracle Proposals, potentially enabling unauthorized update/insert/delete and...

CVE-2026-61263

...

CVE-2026-61207

...

CVE-2026-61172

...

CVE-2026-61157

...

CVE-2026-61147

...

CVE-2026-61141

...

CVE-2026-61132

...

CVE-2026-61109

...

CVE-2026-61104

...

CVE-2026-61098

...

CVE-2026-61087

CVE-2026-61087 affects Oracle PeopleSoft Enterprise FIN Payables (v9.2) — a vulnerability in the Security component that an unauthenticated, network-accessing attacker can exploit via HTTP to access or compromise FIN Payables data. The CVSSv3.1 base score is 7.5 (Impact: Confidentiality) with vec...

CVE-2026-61084

...

CVE-2026-61079

CVE-2026-61079 affects Oracle GoldenGate (Libraries). Affected versions include 19.1.0.0.0–19.30.0.0, 21.3–21.21, and 23.4–23.26.2. The vulnerability is exploitable by a high-privilege attacker who can log on to the infrastructure where GoldenGate runs and requires user interaction. Successful ex...