CVE-2026-90102

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

EUVD-2026-52281

Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure...

EUVD-2026-81695

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

CVE-2026-90102

CVE-2026-90102 is a Linux kernel vulnerability in the NFSv4/pnfs flexfiles layout driver. The per-net data server cache in nfs4_pnfs_ds_add() keyed entries only on the multipath address set, ignoring the NFS version. When one address legitimately serves both NFSv3 and NFSv4 , two deviceids alias ...

CVE-2026-82251 affecting package rust for versions less than 1.96.1-2

CVE-2026-82251 affecting package rust for versions less than 1.96.1-2. A patched version of the package is available...

Atlassian Bitbucket - Remote Command Injection

Atlassian Bitbucket Server and Data Center is susceptible to remote command injection. Multiple API endpoints can allow an attacker with read permissions to a public or private Bitbucket repository to execute arbitrary code by sending a malicious HTTP request, thus making it possible to obtain...

CVE-2026-14311: Missing Authorization

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing ownership verification on /users/customers/ endpoint in all versions up to, and including, 2.4.4. This makes it possible for authenticated...

EUVD-2026-42267

Grav: Stored CSS injection via Markdown image resize bypasses prior media style sanitizers in Grav...

CVE-2026-77405 RabbitMQ amqp091-go: Missing Explicit TLS Minimum Version Configuration In URI Parser

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1 can therefore negotiate an obsolete protocol version when...

HTTP File Server <2.3c - Remote Command Execution

HTTP File Server before 2.3c is susceptible to remote command execution. The findMacroMarker function in parserLib.pas allows an attacker to execute arbitrary programs via a %00 sequence in a search action. Therefore, an attacker can obtain sensitive information, modify data, and/or gain full...

CVE-2026-92364

itsourcecode Leave Management System 1.0 is affected by a SQL injection vulnerability in the file /module/employee/index.php, where manipulation of the ID argument allows an attacker to inject SQL commands. The attack can be initiated remotely and requires low privileges (authenticated access), w...

PT-2026-93495

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the scsi qla2xxx driver. The function qla84xx put chip releases the reference to ha-cs84xx and frees it via qla84xx chip release without clearing the...

CVE-2026-88065 `tts-be` application has a Broken Access Control vulnerability

tts-be is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints such as /api/student/id/photo and /api/courseunit/id/exchange/metadata. By chaining these...

CVE-2026-87274

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.16. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle...

CVE-2026-87270

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.16. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle V...

CVE-2026-87259

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain component: Engineering Communication Interface. The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Orac...

CVE-2026-87215

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Hyperion Financial...

CVE-2026-87203

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial...

CVE-2026-87146

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion component: Access and security. The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-83420

Vulnerability in the PeopleSoft Enterprise FIN Engineering Brazil product of Oracle PeopleSoft component: Engineering. The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN...