CVE-2026-61262

CVE-2026-61262 affects Oracle Teleservice within Oracle E-Business Suite, specifically the Service Diagnostics Scripts component. Affected versions are 12.2.3 through 12.215. The vulnerability allows an unauthenticated attacker with network access over HTTP to modify data (update/insert/delete) a...

CVE-2026-61082

CVE-2026-61082 affects Oracle MySQL Connectors, specifically Connector/J, with vulnerable versions 9.7.0–9.7.1. The vulnerability allows an unauthenticated attacker with network access across multiple protocols to compromise MySQL Connectors, and exploitation requires user interaction. The CVSS 3...

CVE-2026-60842

CVE-2026-60842 affects Oracle Knowledge Management (Oracle E-Business Suite) component Search, with affected versions 12.2.5–12.2.15. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge Management; exploitation requires human interactio...

CVE-2026-60723

CVE-2026-60723 affects Oracle Data Integrator (Oracle Fusion Middleware), specifically the Market Place component. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows a low-privilege user with logon to the underlying infrastructure to compromise Oracle Data Integrator, with ...

CVE-2026-60537

CVE-2026-60537 affects Oracle Fusion Middleware’s Oracle Managed File Transfer (MFT) Runtime Server. Affects 12.2.1.4.0 and 14.1.2.0.0. The issue allows a low-privileged attacker with network access over HTTP to compromise MFT, with potential takeover of the MFT component and impact to confidenti...

CVE-2026-60418

CVE-2026-60418 concerns Oracle Fusion Middleware’s Oracle Unified Directory (OUD Core). Affected are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability can be exploited by a high-privilege attacker with network access via LDAP to compromise OUD, potentially resulting in takeover of Oracle Unified Direc...

CVE-2026-60172

CVE-2026-60172 affects Oracle Autonomous Health Framework (AHF) via the Developer triaging platform. Versions 26.0.0, 26.1.0, and 26.2.0 are affected. The vulnerability is locally exploitable and requires high privileges with user interaction; successful exploitation can lead to takeover of AHF a...

CVE-2026-46936

CVE-2026-46936 affects Oracle MySQL Server (component: Server: DDL) and MySQL Cluster. Affected versions include MySQL Server 8.4.0–8.4.10, 9.7.0–9.7.1 and MySQL Cluster 8.0.0–8.0.47, 8.4.0–8.4.10, 9.7.0–9.7.1. The vulnerability is described as difficult to exploit and requires network access via...

Tattile Camera < 1.181.5 - Default Login

Tattile Smart+, Vega, and Basic device families firmware = 1.181.5 contain a broken authentication caused by default credentials not forced to be changed, letting attackers with management interface access gain administrative privileges. id: CVE-2026-26341 info: name: Tattile Camera 1.181.5 -...

Frontend File Manager < 21.3 - Unauthenticated File Renaming

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server id:...

Integrate Google Drive <= 1.5.3 - Information Disclosure

File Manager for Google Drive - Integrate Google Drive with WordPress plugin for WordPress = 1.5.3 contains sensitive information exposure caused by improper protection of the getlocalizedata function, letting unauthenticated attackers extract Google OAuth credentials and account email addresses,...

Buffalo WSR-2533DHPL2 - Improper Access Control

The web interfaces of Buffalo WSR-2533DHPL2 firmware version = 1.02 and WSR-2533DHP3 firmware version = 1.24 do not properly restrict access to sensitive information from an unauthorized actor. id: CVE-2021-20092 info: name: Buffalo WSR-2533DHPL2 - Improper Access Control author: gy741,pdteam,par...

FREEDOM Administration - Default Login

The Web GUI configuration panel of Hirsch formerly Identiv and Viscount Enterphone MESH through 2024 ships with default credentials username freedom, password viscount. The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires ma...

CVE-2026-16246

In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows group Everyone is granted full control over %ProgramData% instead of being restricted to %ProgramData%\Bizerba\BRAIN2. Starting with BRAIN2 3.09, the setup no longer executes thi...

CVE-2026-49211

Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards %...

golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey

A flaw was found in golang.org/x/crypto/ssh/knownhosts. This vulnerability occurs because the system did not correctly check for the revocation status of a SignatureKey belonging to a Certificate Authority CA. A remote attacker could potentially exploit this by presenting a revoked key, leading t...

Malicious code in @hibachi-xyz/types (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 214e1b690352ce0af70ce6a37d3b7ac4d8dec4269dc7606b7a65fbb6d4406e8b The package presents itself as 'Type definitions' for the @hibachi-xyz scope at version 99.0.0, but index.js exports an empty object and its only...

BIT-PROMETHEUS-2026-40179 Prometheus: Stored XSS via metric names and label values in web UI tooltips and metrics explorer

Prometheus is an open-source monitoring system and time series database. Versions 3.0 through 3.5.1 and 3.6.0 through 3.11.1 have stored cross-site scripting vulnerabilities in multiple components of the Prometheus web UI where metric names and label values are injected into innerHTML without...

undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header

A flaw was found in undici. When undici processes Set-Cookie headers, it incorrectly interprets the SameSite attribute, accepting partial matches instead of exact ones. This allows a malicious server to downgrade a cookie's SameSite policy to a less secure setting, potentially leading to unintend...

CVE-2026-56699 Wazuh Manager - NDJSON Injection in inventory_sync via Agent-Controlled DataValue.index

Wazuh Manager before 5.0.0-beta3 fails to escape the DataValue.index field when constructing OpenSearch bulk requests, allowing enrolled agents to inject arbitrary NDJSON operations. Attackers can smuggle delete, index, or update operations into bulk requests executed under the manager's admin...