EUVD-2026-79132

OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the targ...

CVE-2026-19885 OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of OriginLab Origin Viewer. User interaction is required to exploit this vulnerability in that the targ...

EUVD-2026-79127

Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members Groups dashboard page, resulting in stored cross-site scripting. The add and edit group-folder handlers stored the submitted folder name without neutralizing HTML, and the group...

EUVD-2026-78820

Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP por...

CVE-2026-55701 OpenTelemetry githubreceiver silently ignores configured required_headers authentication

The OpenTelemetry Collector Contrib repository contains components for the OpenTelemetry Collector. Prior to 0.151.0, the githubreceiver validates the receiver/githubreceiver/config.go RequiredHeaders configuration at startup, but receiver/githubreceiver/tracereceiver.go handleReq does not check...

CVE-2026-91751

Flextype CMS versions through 1.0.0-alpha.3 are affected by a path traversal vulnerability in the Entries REST API , caused by improper validation of the id and new_id parameters. Any holder of a valid API token can use traversal sequences in API requests to escape the project's entries directory...

PT-2026-92776

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Endeca Application Controller component allows an unauthenticated attacker with access to the infrastructure where the software execute...

PT-2026-92716

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM Siebel Apps - Life Sciences versions 17.0 through 26.7 Description A flaw in the Life Sciences component allows a low-privileged attacker with access to the infrastructure where the application executes to compromise the...

PT-2026-93098

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.16 Description An issue in the Core component allows an unauthenticated attacker with access to the infrastructure where the software executes to compromise the system. Exploitation requires human interaction a...

PT-2026-93093

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.16 Description An issue in the Core component allows an unauthenticated attacker with logon access to the infrastructure where the software executes to compromise the system. Successful exploitation requires...

PT-2026-93094

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.16 Description A flaw in the Core component allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system. Exploitation is difficult and requires human...

PT-2026-92868

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Control version 12.2.1.4.0 Oracle Fusion Middleware Control version 14.1.2.0.0 Description A flaw in the Framework component allows a low privileged attacker with network access via HTTP to compromise the system...

PT-2026-92816

Name of the Vulnerable Software and Affected Versions Oracle Business Intelligence Enterprise Edition version 8.2.0.0.0 Oracle Business Intelligence Enterprise Edition version 12.2.1.4.0 Oracle Business Intelligence Enterprise Edition version 26.01.0.0.0 Description A flaw in the Platform Securit...

PT-2026-92192

pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target...

PT-2026-92965

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Data Relationship Management version 11.2.26.0.000 Description An issue exists in the Access and security component that allows an unauthenticated attacker with network access via HTTPS to compromise the system. Exploitation...

CVE-2026-81902

Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action removeOrphanedBlocks. A remote attacker could craft a request that, when loaded by an authenticated user holding edit permission on the target page, deleted every block on that page's current...

Astra Linux – Vulnerability in Flatpak

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.4 and 1.12.0, Flatpak applications that had direct access to AFUNIX sockets—such as those used by Wayland, Pipewire, or pipewire-pulse—could trick portals and other host-...

Astra Linux – Vulnerability in lxml

Lxml is a library for processing XML and HTML in the Python language. Prior to version 4.6.5, the HTML Cleaner in lxml.html allowed certain crafted script content to pass through, as well as script content in SVG files embedded using data URIs. Users who use the HTML Cleaner in a security-related...

Astra Linux – Vulnerability in Mariadb 10.3

MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected MariaDB installations. Authentication is required to exploit this vulnerability. The specific flaw resides in the processing ...

Astra Linux – Vulnerability in Zabbix

In Zabbix versions 4.0.x before 4.0.28rc1, 5.0.0alpha1 before 5.0.10rc1, 5.2.x before 5.2.6rc1, and 5.4.0alpha1 before 5.4.0beta2, the CControllerAuthenticationUpdate controller lacks a CSRF protection mechanism. The code within this controller calls diableSIDValidation within the init method. An...