CVE-2026-47026

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: OpenSearch Dashboards. Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

CVE-2026-47028

Vulnerability in the Oracle Document Management and Collaboration product of Oracle E-Business Suite component: Attachments. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-47033

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Contrac...

CVE-2026-47031

Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite component: Bill Issues. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Bills of Material...

CVE-2026-56819

What was affected: Netty versions 4.2.0.Final–4.2.15.Final and 4.1.0.Final–4.1.135.Final. Root cause: when processing HTTP/2 DATA frames for streams whose decompressor had already closed, Http2Decompressor.decompress(...) retains the inbound ByteBuf and does not release it on the error path, leak...

CVE-2026-56819 Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content...

CVE-2026-56819

Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content...

CVE-2026-15957

creationtimestamp| type| source ---|---|--- 2026-07-21 22:09:29+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mr6t5gpv222u 2026-07-21 23:37:44+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6y3aa3s22i 2026-07-22 13:13:56+00:00| seen|...

Integer Overflow

Overview Affected versions of this package are vulnerable to Integer Overflow in the bundled libvips GIF loader VipsForeignLoadNsgif, which can miscompute image dimensions on 32-bit systems. An attacker can crash the process by supplying a GIF whose dimensions overflow the size calculation...

GHSA-HRXH-6V49-42GF gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization engine internal/xds/rbac and the HTTP/2 transport server implementation internal/transport. These vulnerabilities could result in: - Authorization Bypass Fail-Open when translating...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the processing of xDS RBAC policies and HTTP/2 transport handling. An attacker can gain unauthorized access to protected services or cause denial of service by exploiting improper handling of unsupported field...

CVE-2026-8983

creationtimestamp| type| source ---|---|--- 2026-07-21 22:00:07+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6smphxx22y 2026-07-21 22:08:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6t3pjvux23 2026-07-22 01:30:28+00:00| seen|...

EUVD-2026-41613

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth X-Gitea-OTP surface...

GHSA-GX3V-Q759-G323 Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Summary I'm reporting two related TOTP one-time-use defects in Gitea that survive the CVE-2021-45331 fix. The 2018 fix PR 3878 introduced the TwoFactor.LastUsedPasscode field and added an in-memory inequality check on the web 2FA login path. That check works correctly in the single-request case,...

CVE-2026-62563

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.5-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Work in Process...

CVE-2026-62562

Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS US. Successful...

CVE-2026-62521

Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: US Payroll - General. Supported versions that are affected are 12.2.7-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle HRMS US. Successful...

CVE-2026-62503

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Time and Labor...

CVE-2026-62498

Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.7-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Flow...

CVE-2026-62493

CVE-2026-62493 affects Oracle E-Business Suite – Oracle Purchasing (Internal Operations). Affected versions are 12.2.11–12.2.15. The vulnerability is exploitable by a low-privilege user with network access over HTTP and can lead to takeover of Oracle Purchasing. CVSS v3.1 base score is 7.5 (Impac...