MySQL 9.7 -- Multiple vulnerabilities

The Oracle Critical Patch Update of July 2026 addresses 54 issues in Oracle MySQL, 43 of which apply to the MySQL 9.7 series and to the MySQL Router shipped with these ports. The 9.7 branch is affected by every server issue of the 8.4 branch plus twelve additional ones in code paths that only exi...

PT-2026-62231

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, and 26.0.1 Oracle GraalVM for JDK versions 17.0.19 and 21.0.11 Oracle GraalVM Enterprise Edition version 21.3.18 Description A security flaw in the Security componen...

PT-2026-63261

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Missing authorization allows a user with limited feature privileges to access workflow execution outputs within their Kibana space. This occurs because the documented API does not properly...

PT-2026-62432

Name of the Vulnerable Software and Affected Versions Oracle Project Manufacturing version V16 Description A flaw exists in the PJM Command Center component of the Oracle Project Manufacturing product within Oracle E-Business Suite. A high-privileged attacker with access to the infrastructure whe...

PT-2026-63080

Name of the Vulnerable Software and Affected Versions Oracle Identity Manager versions 12.2.1.4.0 Oracle Identity Manager versions 14.1.2.1.0 Description A flaw in the OIM Legacy UI component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise...

PT-2026-62520

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description A flaw in the Content Server component of Oracle Fusion Middleware allows a low privileged attacker with network access via HTTP to compromise...

PT-2026-63075

Name of the Vulnerable Software and Affected Versions Oracle Agile Engineering Data Management version 6.2.1 Description A flaw in the Document Management component allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system. This can le...

PT-2026-62889

Name of the Vulnerable Software and Affected Versions Oracle Transportation Execution versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation requires...

HPESBNW05081 rev.2 - Multiple Vulnerabilities in HPE Aruba Networking AOS-CX

Potential Security Impact: Remote: Directory Traversal, Unauthorized Access, Buffer Overflow SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba CX 10000 Switch Series See Affected Products section for impacted versions. Aruba CX 4100i Switch Series See Affected Products section...

PT-2026-62489

Name of the Vulnerable Software and Affected Versions Oracle TimesTen In-Memory Database version 26.1.1.1.0 Description A flaw in the Kubernetes Operator component allows a low-privileged attacker with access to the infrastructure where the database executes to compromise the system. This issue c...

PT-2026-63162

Name of the Vulnerable Software and Affected Versions Oracle Advanced Benefits version 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Advanced Benefits product of Oracle E-Business Suite. A high privileged attacker with network access via HTTP can compromis...

PT-2026-62691

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description A flaw in the Web Content Management component of Oracle Fusion Middleware allows a low privileged attacker with network access via HTTP to...

PT-2026-63069

Name of the Vulnerable Software and Affected Versions Oracle Agile Product Lifecycle Management for Process version 6.2.4 Description An issue exists in the Installation component of the Oracle Agile Product Lifecycle Management for Process. An unauthenticated attacker with access to the physical...

PT-2026-62720

Vulnerability in the Oracle Scheduler product of Oracle E-Business Suite component: Rules UI. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Scheduler. Successful attacks of...

PT-2026-63221

Name of the Vulnerable Software and Affected Versions Oracle Learning Management versions 12.2.3 through 12.2.15 Description An issue exists in the Import And Export component of the Oracle Learning Management product within Oracle E-Business Suite. A low privileged attacker with network access v...

EUVD-2026-44355

Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability...

CVE-2026-55550

NextCRM is open-source customer relationship management CRM software. The CRM product catalog is an organization-wide business object. Normal application server actions restrict product creation, update, and deletion to manager and admin roles. However, in version 0.12.1, the MCP product tools...

CVE-2026-13381 VSee Clinic and API Insecure Direct Object Reference in File API Allows Unauthorized File Access and Deletion

VSee Clinic 7.1.26 and API 1.3.0 contain an Insecure Direct Object Reference IDOR vulnerability in the /v1.3.0/api/files endpoint. An authenticated attacker can manipulate the 'remark' request parameter to enumerate, retrieve, and delete files belonging to other users on the application server...

CVE-2026-13381

VSee Clinic 7.1.26 and API 1.3.0 expose an Insecure Direct Object Reference (IDOR) in the /v1.3.0/api/files endpoint. An authenticated attacker can modify the remark parameter to enumerate, access, and delete files owned by other users, impacting confidentiality, integrity, and availability. Root...

google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation

A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 :path pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed :path that omits the mandato...