CVE-2026-39040: Improper Neutralization of Input During Web Page Generation

BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting XSS via the component Trufflebox UI trufflebox-ui in ExpressionViewModal.jsx...

CVE-2026-39039

The BharatMLStack software (up to and including v1.3.0 ) contains a vulnerability in the Trufflebox UI where it stores sensitive information in the browser's localStorage . Specifically, the JWT authentication token , full user object , and session ID are stored in a manner that makes them fully ...

CVE-2026-39039

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page...

EUVD-2026-78941

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page...

CVE-2026-39039: Improper Neutralization of Input During Web Page Generation

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page...

CVE-2026-39040

BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting XSS via the component Trufflebox UI trufflebox-ui in ExpressionViewModal.jsx...

CVE-2026-39039

In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaScript running on the page...

ROS-20260915-73-0187

The vulnerability of the SplitView component in Google Chrome and Microsoft Edge relates to the improper presentation of critical information to the user interface. Exploiting this vulnerability can allow an attacker to compromise data integrity and also cause service interruptions through the us...

CVE-2026-83042: Improper Authentication

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: OIM Legacy UI. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identit...

CVE-2026-83217: Improper Access Control

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM component: Open UI. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this...

CVE-2026-83422: Improper Access Control

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: OIM Legacy UI. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Identit...

CVE-2026-83301: Improper Privilege Management

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Service Administration UI. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

CVE-2026-83203: Improper Access Control

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM component: Open UI. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this...

CVE-2026-73943: Improper Access Control

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: OIM Legacy UI. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Identit...

CVE-2026-91994: Missing Authorization

Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or taskrunner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoi...

PT-2026-92669

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM component: Open UI. Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks requir...

ROS-20260915-73-0060

The vulnerability of the PointerLock component in Microsoft Edge and Google Chrome is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to replace the user interface with a specially created HTML page...

PT-2026-92677

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM component: Open UI. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Siebel CRM End User. Successful attacks of this...

PT-2026-92740

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM component: Open UI. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this...

PT-2026-92715

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM versions 17.0 through 26.7 Description A flaw exists in the Open UI component of the Siebel CRM End User product. This issue allows an unauthenticated attacker with network access via HTTP to compromise the system, which coul...