PT-2026-92500

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Portlet Services. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

PT-2026-92789

Name of the Vulnerable Software and Affected Versions Oracle JDeveloper version 12.2.1.4.0 Oracle JDeveloper version 14.1.2.0.0 Description A flaw in the Resource Catalog Services component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise t...

PT-2026-92828

Name of the Vulnerable Software and Affected Versions Oracle JDeveloper version 12.2.1.4.0 Oracle JDeveloper version 14.1.2.0.0 Description A flaw exists in the Resource Catalog Services component of Oracle Fusion Middleware. A low privileged attacker with network access via HTTP can exploit this...

PT-2026-92871

Name of the Vulnerable Software and Affected Versions Oracle Database Server versions 19.3 through 19.32 Oracle Database Server versions 21.3 through 21.23 Oracle Database Server versions 23.4.0 through 23.26.3 Description An issue exists in the Oracle Net Services component. An unauthenticated...

PT-2026-92856

Name of the Vulnerable Software and Affected Versions Oracle Web Services Manager versions 12.2.1.4.0 Oracle Web Services Manager versions 14.1.2.0.0 Description A flaw in the Web Services Security component allows an unauthenticated attacker with network access via SOAP to compromise the system...

CVE-2026-83333: Uncontrolled Resource Consumption

Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Net Services. Successful attacks of this...

CVE-2026-91923: Server-Side Request Forgery (SSRF)

KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unvalidated caller-supplied URLs without allowlist restrictions. Authenticated attackers can supply arbitrary URLs to reach internal services and exfiltrate...

CVE-2026-83103: Improper Access Control

Vulnerability in the Oracle Forms product of Oracle Fusion Middleware component: Forms Services, C/S, Charmode. Supported versions that are affected are 12.2.1.19.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-11927: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services...

Server-side Request Forgery (SSRF)

Overview mcp-atlassian is a The Model Context Protocol MCP Atlassian integration is an open-source implementation that bridges Atlassian products Jira and Confluence with AI language models following Anthropic's MCP specification. This project enables secure, contextual AI interactions with...

CVE-2026-91079

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images...

EUVD-2026-77714

Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist validation. Authenticated workspace members can supply arbitrary URLs to the print endpoint, which Puppeteer renders and returns as downloadable PDFs or images...

UBUNTU-CVE-2026-90995

A flaw was found in SSSD System Security Services Daemon. A local attacker with privileges to connect to the PAM Pluggable Authentication Modules responder socket can send a specially crafted protocol request. If the pamappservices configuration is enabled and the service item is omitted from the...

CVE-2026-90995

A flaw was found in SSSD System Security Services Daemon. A local attacker with privileges to connect to the PAM Pluggable Authentication Modules responder socket can send a specially crafted protocol request. If the pamappservices configuration is enabled and the service item is omitted from the...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, NSS

A mismatch between the allocator and deallocator could have led to memory corruption. This vulnerability affects Firefox 128, Firefox ESR 115.13, Thunderbird 115.13, and Thunderbird 128...

Astra Linux – Vulnerability in Consul

HashiCorp Consul and Consul Enterprise 1.10.1: The TXN.Apply endpoint allows for the registration of proxies for other services, enabling access to service traffic. This feature was fixed in versions 1.8.15, 1.9.9, and 1.10.2...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerabilities have been resolved: EFI: Fixed NULL dereference in the init error path. In cases where runtime services are not supported or have been disabled, the runtime services’ workqueue will never be allocated. Do not attempt to destroy the workqueue...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: efi: runtime: avoid EFIv2 runtime services on Apple x86 machines Aditya reports that his recent MacBookPro crashes during firmware updates when variable services are used at runtime. The culprit seems to be a call to...

Astra Linux – Vulnerability in nss

NSS has demonstrated timing differences during the execution of DSA signatures, which can be exploited and may eventually lead to the leakage of private keys. This vulnerability affects Thunderbird versions 68.9.0, Firefox versions 77, and Firefox ESR versions 68.9...

Astra Linux – Vulnerabilities in Firefox, Thunderbird, NSS

NSS was vulnerable to a timing-side-channel attack during RSA decryption. This attack could potentially allow an attacker to retrieve private data. This vulnerability affects Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9...