PT-2026-62253

Name of the Vulnerable Software and Affected Versions MySQL Cluster versions 8.0.0 through 8.0.47 Description An issue exists in the Server: Optimizer component of MySQL Cluster. A high privileged attacker with network access via multiple protocols can exploit this flaw to cause a hang or a...

PT-2026-63015

Name of the Vulnerable Software and Affected Versions Oracle Commerce Platform version 11.4.0 Description An issue exists in the ATG Portals component of the Oracle Commerce Platform. An unauthenticated attacker with network access via HTTP can exploit this flaw to compromise the system, which ma...

PT-2026-61995

Name of the Vulnerable Software and Affected Versions Eclipse OMR versions prior to 0.12 Description The arraycmp SIMD implementation for Z and P fails to verify if the number of bytes to be compared is zero. SIMD Single Instruction, Multiple Data is a type of parallel processing that allows a...

PT-2026-62027

Name of the Vulnerable Software and Affected Versions Eclipse OpenJ9 versions prior to 0.61 Description An issue occurs when executing class files where a superclass method, which was previously concrete, has been recompiled as abstract. In this scenario, the execution is incorrectly delegated to...

PT-2026-63043

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description An issue exists in the Experience Manager component that allows an unauthenticated attacker with network access via RMI Remote Method Invocation, a...

PT-2026-61858

Name of the Vulnerable Software and Affected Versions libssh affected versions not specified Description A flaw exists where a remote authenticated peer can advertise a zero maximum packet size within the SSH MSG CHANNEL OPEN message. This causes subsequent channel writes to enter an infinite loo...

PT-2026-61854

Name of the Vulnerable Software and Affected Versions Apache Fory versions 0.5.0 through 1.3.x Description An out-of-bounds read occurs via sun.misc.Unsafe when out-of-band zero-copy deserialization is utilized. In this scenario, the readAlignedVarUint function can read data beyond the boundaries...

PT-2026-62126

The DesignWare SPI driver drivers/spi/spi dw.c computed the SPI BAUDR clock divider as info-clock frequency / config-frequency without validating config-frequency. spi transceive is a Zephyr syscall and its verify handler drivers/spi/spi handlers.c copies the caller-supplied spi config from...

PT-2026-62457

Name of the Vulnerable Software and Affected Versions Oracle HTTP Server versions 12.2.1.4.0 Oracle HTTP Server versions 14.1.2.0.0 Description An issue exists in the Apache Plugin component of Oracle Fusion Middleware. This flaw allows an unauthenticated attacker with network access via HTTP to...

Security update for chromium (important)

openSUSE security update: security update for chromium ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21382-1 Rating: important References: bsc1271656 Cross-References: CVE-2026-15899 CVE-2026-15900 CVE-2026-15901 CVE-2026-15902 CVE-2026-15903...

PT-2026-62148

Name of the Vulnerable Software and Affected Versions Oracle Retail Integration Bus version 16.0.3 Description A flaw in the RIB Kernal component of the Oracle Retail Integration Bus allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation...

PT-2026-63030

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Content Acquisition System component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successf...

Oracle Linux 8 : .NET / 10.0 (ELSA-2026-41900)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-41900 advisory. 10.0.110-1.0.1 - Add support for Oracle Linux 10.0.110-1 - Update to .NET SDK 10.0.110 and Runtime 10.0.10 - Resolves: RHEL-192459 Tenable has extract...

EUVD-2026-43741

Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of service...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HTTP/2 stream handling of lib/adapters/http.js, which does not enforce maxBodyLength on stream...

EUVD-2026-44672

Directus: SSRF Protection Bypass via 0.0.0.0 in File Import...

Directus: SSRF Protection Bypass via 0.0.0.0 in File Import

Summary The SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0. While 127.0.0.1 and other internal addresses are denied, 0.0.0.0 is not added to the blocklist. On Linux and macOS, connecting to 0.0.0.0 reaches localhost, so an authenticated user...

GHSA-J5H6-VQC3-PHQH Directus: SSRF Protection Bypass via 0.0.0.0 in File Import

Summary The SSRF protection on Directus's file-import-from-URL feature can be bypassed using the address 0.0.0.0. While 127.0.0.1 and other internal addresses are denied, 0.0.0.0 is not added to the blocklist. On Linux and macOS, connecting to 0.0.0.0 reaches localhost, so an authenticated user...

CVE-2026-56452

Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for client-side and server-side SSH. The implementation of receiving files or directories via SCP did not validate filenames in SCP "C" or "D" commands. A malicious sender could send filenames...

CVE-2026-44584

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the email update functionality fails to invalidate the existing verification state when a user changes their email address, allowing a verified account to retain its verified statu...