PT-2026-78159

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon version 4.5.0 Description A flaw in the Imperative Web Server component allows an unauthenticated attacker with network access via HTTP to compromise the system. Exploitation requires human interaction and can...

PT-2026-77999

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Experience Manager component allows a high privileged attacker with network access via HTTP to compromise the system. This issue can le...

PT-2026-78137

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.14 Description A flaw in the Core component allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system. This issue can lead to unauthorized access to...

PT-2026-77888

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Data Relationship Management version 11.2.25.0.000 Description A flaw in the Access and security component allows a low privileged attacker with access to the infrastructure where the software executes to compromise the system...

PT-2026-77802

Name of the Vulnerable Software and Affected Versions Oracle Call Center Technology versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. This issue can lead to unauthorized...

CVE-2026-75051

In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...

CVE-2026-15754 Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal

Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC attribute-based access control policy...

CVE-2026-15754 Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal

Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC attribute-based access control policy...

CVE-2026-15754 Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal

Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC attribute-based access control policy...

MINI-5C48-F38R-M9PX

Bulletin has no description...

MINI-JQ7P-FJWG-CWV3

Bulletin has no description...

BIT-AIRFLOW-2026-68076 Apache Airflow: Connections test API: team-scope guard bypass resolves another team's environment Connection

Apache Airflow's environment-variable secrets backend resolved a team-scoped Connection or Variable from the wrong team's scope. The guard meant to prevent this only ran when no team scope was supplied, and its pattern could not match a team name containing an underscore, which team names are...

FreeBSD : gitea -- Multiple vulnerabilities (2f3568eb-999e-11f1-a655-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2f3568eb-999e-11f1-a655-3497f65b111b advisory. Gitea reports This release contains fixes for 45 security issues, including privilege...

Probo 0.222.2 - IDOR

Exploit Title: Probo 0.222.2 - IDOR Date: 2026-07-17 Exploit Author: Pig-Tail Jorge González Milla Vendor Homepage: https://github.com/getprobo/probo Software Link: https://github.com/getprobo/probo Version: cross-tenant read. Advisory: GHSA-c74x-79w6-63jh. NOTE: PoC is a Go test using...

PT-2026-73387

An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges...

PT-2026-76700

Name of the Vulnerable Software and Affected Versions JetBrains YouTrack versions prior to 2026.2.17917 Description An issue exists that allows the unauthorized transfer of projects between organizations. Recommendations Update to version 2026.2.17917...

UBUNTU-CVE-2026-72183

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...

EUVD-2026-59420

In the Linux kernel, the following vulnerability has been resolved: cxl/region: Block region delete during region creation Expand the range lock, rename it "regionslock", to disable region deletion in the critical period between constructregion and attachtarget, as well as the period between...

EUVD-2026-58941

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...

CVE-2026-72183 landlock: Fix LANDLOCK_SCOPE_SIGNAL bypass on the SIGIO path

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix LANDLOCKSCOPESIGNAL bypass on the SIGIO path LANDLOCKSCOPESIGNAL must prevent a sandboxed process from signaling processes outside its Landlock domain. It can be bypassed through the asynchronous SIGIO delivery path...