29278 matches found
EUVD-2026-47364
Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Commerce Guided...
EUVD-2026-47031
Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: XML Services. Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI...
EUVD-2026-46922
Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: REST WebServices. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...
EUVD-2026-46708
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: WLS - Web Services. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP ...
EUVD-2026-46527
Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Net Services...
EUVD-2026-46490
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Web Services Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the imageurl parameter in the chat completions endpoint. An attacker can access internal services and cloud metadata endpoints by supplying a crafted URL that redirects to internal addresses, as...
CVE-2026-61283
Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite component: Web Services. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material...
CVE-2026-61154
Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided...
CVE-2026-61155
Vulnerability in the Oracle Commerce Guided Search Platform Services product of Oracle Commerce component: Forge. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided...
CVE-2026-61102
Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications component: Infrastructure. Supported versions that are affected are 14.6.0-14.8.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...
CVE-2026-47040
Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.3-21.22 and 23.4.0-23.26.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Net Services...
CVE-2026-47001
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Web Services Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise...
CVE-2026-47063
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and...
EUVD-2026-46421
mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visitpage tool, which only validates the URL protocol without filtering private or reserved IP...
CVE-2026-46556
FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata...
CVE-2026-65056 mcp-webresearch Server-Side Request Forgery in visit_page Due to Missing Internal-IP Filtering
mcp-webresearch 0.1.7 contains a server-side request forgery vulnerability that allows attackers to access internal network services by supplying loopback, link-local, or cloud metadata addresses to the visitpage tool, which only validates the URL protocol without filtering private or reserved IP...
GHSA-H2X6-G7Q6-344V Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass
Summary Gitea's repository migration URL validation can be bypassed when a migration hostname resolves to multiple IP addresses. The validation logic accepts the destination if any resolved IP is allowed, even if another resolved IP is loopback, private, or otherwise blocked. The later git clone...
Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim
Summary When oauth2client UPDATEAVATAR = true is enabled, Gitea fetches the avatar URL received from an OAuth2/OIDC provider using Go's default HTTP client. The URL comes from the user's OAuth/OIDC avatar value, commonly the OIDC picture claim. The affected code path calls http.Geturl without...