CVE-2026-70913

CVE-2026-70913 is a critical vulnerability (CVSS 3.1: 9.8) in the Core component of Oracle Identity Manager (Oracle Fusion Middleware), affecting supported versions 12.2.1.4.0 and 14.1.2.1.0 . An unauthenticated attacker with network access via HTTP can exploit this vulnerability to achieve full ...

CVE-2026-70915

Oracle Identity Manager (part of Oracle Fusion Middleware, component Core ) is affected in versions 12.2.1.4.0 and 14.1.2.1.0 . A low-privileged attacker with network access via T3 or IIOP can exploit this vulnerability with low complexity and no user interaction to achieve full takeover of the p...

CVE-2026-70757

CVE-2026-70757 is a critical vulnerability in Oracle WebLogic Server (Oracle Fusion Middleware, component: Core) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 . An unauthenticated attacker with network access via T3 or IIOP can compromise the server, resulting in full take...

CVE-2026-70756

CVE-2026-70756 is a critical vulnerability in the Core component of Oracle WebLogic Server (Oracle Fusion Middleware), affecting supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0. An unauthenticated attacker with network access via T3 or IIOP can exploit this vulnerability to ...

CVE-2026-70755

CVE-2026-70755 affects the File download component of Oracle Web Applications Desktop Integrator (part of Oracle E-Business Suite), versions 12.2.3 through 12.2.15 . A low-privileged attacker with network access via HTTP can exploit this vulnerability to gain unauthorized access to critical data ...

CVE-2026-70748

Oracle WebLogic Server (Oracle Fusion Middleware, component: Core ) in versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 is affected by a critically rated vulnerability (CVSS 3.1: 9.8 ). An unauthenticated attacker with network access via the T3 or IIOP protocols can exploit this flaw w...

CVE-2026-62597

Oracle Enterprise Manager Base Platform (component: Event Management ) versions 13.5 and 24.1 are affected by an easily exploitable vulnerability. A low-privileged attacker with network access via SOAP can compromise the platform, resulting in unauthorized creation, deletion, or modification of c...

CVE-2026-87288

Oracle GraalVM (component: Compiler ), part of Oracle Java SE, is affected in supported version 25.0.4.1 . The vulnerability allows an unauthenticated attacker with network access via HTTP to achieve takeover of Oracle GraalVM, with high impact on confidentiality, integrity, and availability. The...

CVE-2026-87287

CVE-2026-87287 affects the Compiler component of Oracle GraalVM 25.0.4.1 (part of Oracle Java SE). A difficult-to-exploit vulnerability allows an unauthenticated attacker with network access via HTTP to compromise the product, resulting in full takeover of Oracle GraalVM. The CVSS 3.1 base score ...

CVE-2026-87286

Oracle GraalVM (component: Compiler ), version 25.0.4.1 , is affected by a vulnerability that allows an unauthenticated attacker with network access via HTTP to achieve full takeover of the product. The vulnerability is rated CVSS 8.1 (HIGH) with high impact on confidentiality, integrity, and ava...

CVE-2026-18425

Concrete CMS 9 (versions 9.0.0 through 9.5.2) contains an IDOR flaw in the dashboard sitemap reorder action (SitemapUpdate::updateDisplayOrder). The controller checks only the global access_sitemap task permission and omits any per-page edit permission check, allowing an authenticated user with s...

CVE-2026-18424

Concrete CMS versions 9.0.0 through 9.5.2 are affected by a Server-Side Request Forgery (SSRF) vulnerability in the remote file import feature. The root cause is a cross-port reuse of a validated DNS pin : when multiple URLs share the same host, only the first ValidatedRemoteUrl is retained and r...

CVE-2026-32599

Netmaker (a WireGuard network manager) is vulnerable to boolean-based SQL injection in its SQLite database layer. Prior to version 1.5.0 , the sqliteDeleteRecord function builds SQL DELETE statements via direct string concatenation of user-supplied input from the DELETE /api/dns/{network}/{domain...

CVE-2026-61544

libp2p-quic (part of the official Rust libp2p networking stack) is vulnerable to a remote unauthenticated denial-of-service prior to version 0.13.1. During an inbound QUIC handshake, a malicious peer can present a valid short-lived libp2p TLS certificate and delay the final TLS 1.3 handshake frag...

CVE-2026-88922

go-getter (HashiCorp), a library used for fetching and extracting files, is vulnerable to a privilege escalation in its archive decompression handling in versions up to 1.8.8 and 2.2.3 . A crafted archive may cause extracted files to be created with elevated permission bits. When extraction is pe...

CVE-2026-92240

A malicious or compromised IMAP server can trigger an out-of-bounds read in the IMAP response parser in Thunderbird by sending an untagged * ID response, causing the application to crash. The affected parsing path is reachable before authentication , broadening the attack surface. The vulnerabili...

CVE-2026-92239

CVE-2026-92239 is a buffer overrun vulnerability in Thunderbird's IMAP handling. A maliciously constructed IMAP line can trigger an out-of-bounds buffer read , potentially exposing sensitive data to an attacker who controls the IMAP response. The issue was fixed in Thunderbird 140.16 . Additional...

CVE-2026-92238

CVE-2026-92238 affects Thunderbird , the Mozilla email client. The vulnerability involves ambiguous parsing of mail headers , where a maliciously constructed header could cause multiple fields to be parsed as a single field, or lead to potential memory safety violations . The issue was fixed in T...

CVE-2026-76820

OpenCTI, an open-source cyber threat intelligence platform, is affected by a Server-Side Request Forgery (SSRF) in the synchronizerFetch GraphQL query prior to version 7.260701.0 . The backend's fetchRemoteStreams function validated only the HTTP/HTTPS scheme without applying the ingestion deny l...

CVE-2026-76821

OpenCTI , an open-source cyber threat intelligence platform, is vulnerable to user-controlled ReDoS in the JSON ingestion mapper's extractWithRegexp formula function (prior to 7.260706.0 ). The function compiled a user-supplied regular expression with the JavaScript RegExp engine without validati...