CVE-2026-13182

The vulnerability CVE-2026-13182 affects Progress Telerik UI for ASP.NET AJAX (RadAsyncUpload) up to version 2026.2.708. The issue arises from RadAsyncUpload client-state processing that can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that may leak protected ...

EUVD-2026-47306

Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications component: Security. Supported versions that are affected are 7.5.0, 7.5.1, 7.6.0, 7.7.0, 7.8.0 and 8.0.1. Easily exploitable vulnerability allows low privileged attacker with network access v...

PT-2026-63396

In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers...

PT-2026-63490

Name of the Vulnerable Software and Affected Versions BandiZip version 7.37 Description An authentication bypass issue exists that allows remote attackers to circumvent the Mark-of-the-Web protection mechanism. Mark-of-the-Web is a security feature used by operating systems to identify files that...

Plone < 3.3.6 XSS

The version of Plone installed on the remote host is prior to 3.3.6. It is, therefore, affected by a cross-site scripting XSS vulnerability, in PortalTransforms due to improper validation of user-supplied input before returning it to users. An unauthenticated, remote attacker can exploit this, by...

CVE-2025-50325

BandiZip v.7.37 is affected by a Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of BandiZip...

CVE-2026-60468

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebCenter Content:...

EUVD-2026-46140

FlareSolverr before version 3.4.7 contains a server-side request forgery SSRF vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information...

PT-2026-62463

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Service Delivery Platform Messaging Enabler version 12.2.1.4.0 Oracle Fusion Middleware Service Delivery Platform Messaging Enabler version 14.1.2.0.0 Description A flaw in the Messaging Enabler component allows a...

dotnet: .NET Security Feature Bypass Vulnerability

A flaw was found in .NET. An unauthorized attacker can exploit this vulnerability over a network due to improper verification of cryptographic signatures. This allows the attacker to bypass a critical security feature, potentially leading to significant compromise of confidentiality, integrity, a...

CVE-2026-53395

A flaw was found in the Linux kernel's Network File System NFS daemon nfsd. A remote attacker can exploit this vulnerability by sending specially crafted NFS CREATE requests that include conflicting Access Control List ACL attributes. This leads to a memory leak, where the system fails to release...

dotnet: .NET: Denial of Service due to uncontrolled resource allocation

A flaw was found in .NET where uncontrolled allocation of resources can lead to a Denial of Service DoS. An unauthorized remote attacker could exploit this vulnerability by continuously requesting resources without limits or throttling, causing the affected system to become unresponsive or crash...

dotnet: .NET Framework: Denial of Service via improper input validation

A flaw was found in .NET Framework. This improper validation of input allows an unauthorized attacker to remotely deny service over a network. This vulnerability can lead to a Denial of Service DoS condition, making the affected system unavailable to legitimate users...

dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation

A flaw was found in .NET where uncontrolled resource allocation can be exploited by an unauthorized attacker over a network. This vulnerability allows the attacker to exhaust available resources, leading to a Denial of Service DoS condition. The lack of limits or throttling mechanisms enables an...

dotnet: .NET Core: Denial of Service via type confusion

A flaw was found in .NET Core. This vulnerability, known as type confusion, allows an unauthorized remote attacker to cause a denial of service DoS over a network. By exploiting this flaw, an attacker can make the affected system unavailable to legitimate users...

ElasticSearch v1.1.1/1.2 RCE

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. Be aware this only violates the vendor's intended security policy if the user does not run...

SimpleHelp <= 5.5.7 - Unauthenticated Path Traversal

SimpleHelp remote support software v5.5.7 and before is vulnerable to multiple path traversal vulnerabilities that enable unauthenticated remote attackers to download arbitrary files from the SimpleHelp host via crafted HTTP requests. These files include server configuration files containing...

ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation

A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized remote attacker to cause a Denial of Service DoS by allocating resources without proper limits or throttling. This can lead to the affected system becoming unresponsive or unavailable to legitimate users...

PT-2026-61740

Name of the Vulnerable Software and Affected Versions Grav CMS scheduler-webhook plugin affected versions not specified Description An authentication bypass exists in the scheduler-webhook plugin due to a short-circuit logic flaw during webhook token validation. This allows unauthenticated remote...

CVE-2026-15093 Multiple Vulnerabilities in IBM Engineering AI hub.

IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a remote attacker to redirect users to malicious websites due to improper validation of user-supplied URLs...