CVE-2026-73963

CVE-2026-73963 is a critical (CVSS 9.8) vulnerability in Oracle WebCenter Portal (Oracle Fusion Middleware), specifically the Portlet Services component, affecting versions 12.2.1.4.0 and 14.1.2.0.0 . An unauthenticated attacker with network access via HTTP can exploit this vulnerability to achie...

CVE-2026-73957

CVE-2026-73957 affects Oracle WebCenter Portal (component: Portlet Services ) in Oracle Fusion Middleware , versions 12.2.1.4.0 and 14.1.2.0.0 . An unauthenticated attacker with network access via HTTP can compromise the product, but successful exploitation requires user interaction from someone ...

EUVD-2026-79311

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Portlet Services. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-73953

Oracle WebCenter Portal (a component of Oracle Fusion Middleware) is affected via its Portlet Services component. An unauthenticated attacker with network access via HTTP can exploit this vulnerability to achieve takeover of the portal. Supported affected versions are 12.2.1.4.0 and 14.1.2.0.0 . ...

EUVD-2026-79307

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Portlet Services. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-73951

Oracle WebCenter Portal (component: Portlet Services ) is affected by a vulnerability in supported versions 12.2.1.4.0 and 14.1.2.0.0 . The flaw allows an unauthenticated attacker with network access via HTTP to achieve takeover of the portal, with high impact to confidentiality, integrity, and a...

EUVD-2026-79306

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Portlet Services. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-73952

CVE-2026-73952 affects the Portlet Services component of Oracle WebCenter Portal (Oracle Fusion Middleware), versions 12.2.1.4.0 and 14.1.2.0.0 . An unauthenticated attacker with network access via HTTP can exploit this with low complexity to achieve unauthorized creation, deletion, modification,...

EUVD-2026-79305

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Portlet Services. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

EUVD-2026-79303

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Portlet Services. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-73949

A vulnerability in the Portlet Services component of Oracle WebCenter Portal (part of Oracle Fusion Middleware) affects supported versions 12.2.1.4.0 and 14.1.2.0.0 . A low-privileged attacker with network access via HTTP can exploit this vulnerability without user interaction to achieve full tak...

CVE-2026-18424 Concrete CMS 9.0.0 to 9.5.2 is vulnerable to SSRF protection bypass in remote file import when multiple URLs share a host but use different ports

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first ValidatedRemoteUrl is retained and reused for every later URL with that host. A...

CVE-2026-76693 Unauthenticated Denial-of-Service Vulnerability in HPE Networking EdgeConnect SD-WAN Gateways

A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated remote attacker to cause a denial-of-service against certain services running on impacted Gateways...

CVE-2026-11927

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

CVE-2026-58485

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, weburlread receives its caller-controlled URL through src/index.ts and validates only the literal hostname in assertUrlAllowed within src/url-reader.ts...

CVE-2026-11927 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

CVE-2026-11927 Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

EUVD-2026-78892

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

CVE-2026-11927

The IBM Security Verify Identity Access reverse proxy is vulnerable to a flaw where parameters can be injected into requests sent to third-party services. This issue is classified under CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') . Th...

CVE-2026-54549

meta-ads-mcp (a Model Context Protocol server for Meta Ads) contains a Server-Side Request Forgery (SSRF) in the upload_ad_image tool. Prior to v1.0.115 , an attacker-controlled image_url parameter is passed to httpx.AsyncClient with follow_redirects=True and no scheme, host, or IP validation , e...