CVE-2026-90849

CVE-2026-90849 affects SourceCodester College Notes Gallery Management System 1.0 . The vulnerability is a SQL injection in the file /College/login.php, triggered by manipulation of the User argument. The attack vector is remote with no authentication required and low complexity . Per the CVSS 3....

CVE-2026-91774 Yao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint

Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers can supply a known team identifier to retrieve sensitive team data including name, description, owner information, and settings without...

Chromium CVE-2026-87445: UI misrepresentation in Session

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

PT-2026-92546

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware component: Client Bundle. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication...

PT-2026-92194

pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target...

PT-2026-92192

pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target...

PT-2026-92666

Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM component: eDetailing. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Life Sciences...

PT-2026-93100

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.16 Description A flaw in the Core component allows a high privileged attacker with access to the infrastructure where the software executes to compromise the system. The attack requires human interaction from a...

PT-2026-92336

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An out-of-bounds read occurs in multiple files due to type confusion, which is a situation where a program accesses a resource using a type that is different fro...

PT-2026-92357

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A race condition exists in multiple locations, leading to a time-of-check to time-of-use TOCTOU issue. This flaw allows for local escalation of privilege,...

PT-2026-92659

Name of the Vulnerable Software and Affected Versions Oracle iStore versions 12.2.3 through 12.2.15 Description A flaw in the Shopping Cart component allows a low privileged attacker with network access via HTTP to compromise the system. The attack requires human interaction and can lead to...

PT-2026-92868

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Control version 12.2.1.4.0 Oracle Fusion Middleware Control version 14.1.2.0.0 Description A flaw in the Framework component allows a low privileged attacker with network access via HTTP to compromise the system...

ROS-20260915-73-0178

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge relates to the false representation of critical information to the user interface. Exploiting this vulnerability could allow an attacker to compromise data integrity remotely...

PT-2026-92282

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic error in the code allows for an out-of-bounds write in multiple locations. This condition can be exploited to achieve remote code execution without...

PT-2026-92302

Name of the Vulnerable Software and Affected Versions VPU affected versions not specified Description An integer overflow in VPU can lead to an out-of-bounds write, which is a condition where data is written outside the intended memory boundary. This issue allows for local escalation of privilege...

CVE-2026-48722: Incorrect Default Permissions

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to $NXFHOME:-/.nextflow/seqera-auth.config through AuthCommandImpl.writeConfig in...

CVE-2026-81922: Missing Authorization

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the sendtotop and sendtobottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

ROS-20260915-73-0064

The vulnerability of the Tab Hover Cards component in Google Chrome and Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow an attacker to replace a domain name using a created domain name...

PT-2026-92288

Name of the Vulnerable Software and Affected Versions Bootloader affected versions not specified Description A missing permission check in the Bootloader allows for a local escalation of privilege. This issue enables an attacker to obtain System execution privileges without requiring any user...

CVE-2026-83176: Improper Privilege Management

Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite component: CRM User Management Framework. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...