CVE-2026-70921 is a critical vulnerability affecting the Security component of Oracle Hyperion Financial Management (HFM). The flaw exists in version
CVE-2026-70919 is a vulnerability identified in the Security component of Oracle Hyperion Financial Management. The affected release is version 11.2.25.0.000,
CVE-2026-70929 is a critical improper authorization vulnerability identified within the Security component of Oracle Hyperion Financial Management (HFM). The flaw
CVE-2026-70914 addresses a critical security flaw within the Oracle Hyperion Financial Management product, specifically in its Security component. This vulnerability
CVE-2026-70770 resides in the Oracle Warehouse Management component of Oracle E-Business Suite, specifically within the Internal Operations sub-module. This vulnerability
This vulnerability resides in the Security component of Oracle Hyperion Financial Management, a critical application used for financial consolidation and
CVE-2026-70928 is a critical SQL injection vulnerability affecting the Oracle Hyperion Financial Management (HFM) product, specifically within its Security component.
CVE-2026-70754 details a critical oversight in Oracle Hyperion Financial Reporting. The vulnerability resides within the Server component of the product.
Vulnerability Deep Dive CVE-2026-70753 is a vulnerability identified in the Oracle Hyperion Financial Reporting product, specifically within its Server component.
CVE-2026-70920 is a critical vulnerability identified in the Security component of Oracle Hyperion Financial Management (HFM). The affected version is
CVE-2026-70769 is a vulnerability identified in the Oracle Hyperion Financial Reporting product, specifically within its Server component. The affected version
CVE-2026-61302 is a critical security flaw identified in Oracle Business Intelligence Enterprise Edition (BI EE), specifically targeting the Pod Admin
CVE-2026-16864 is a critical stack-based buffer overflow vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM
CVE-2026-70911 is a vulnerability identified in the Oracle Hyperion Financial Management product, specifically within its Security component. The affected version
The Phalcon Volt template compiler contains a critical vulnerability in its join filter implementation. The compiler generates PHP code by
CVE-2026-71110 is a high-severity vulnerability affecting Oracle Helidon, a microservices framework within Oracle Fusion Middleware. The flaw resides in the
The disclosed vulnerability resides in the Imperative Web Server component of Oracle Helidon version 4.5.0, part of the Oracle Fusion
CVE-2026-76041 is a high-severity information disclosure vulnerability identified in Google Chrome’s Skia graphics engine. Skia is an open-source 2D graphics
The vulnerability exists in the Unleash OSS server’s request-validation error handling, specifically within the shared error formatting path. An unauthenticated
CVE-2026-73939 is a high-severity vulnerability affecting the Helidon product of Oracle Fusion Middleware, specifically within its Imperative Web Server component.
CVE-2026-76039 describes a critical logic flaw residing in the reference resolution mechanism within the Core component of Google Chrome for
CVE-2026-73892 is a vulnerability identified in the Helidon product of Oracle Fusion Middleware, specifically within its Imperative Web Server component.
Grav CMS versions 2.0.0 through 2.0.19 contain a critical vulnerability that allows authenticated users with page-edit privileges to execute arbitrary
CVE-2026-73893 is a vulnerability identified in Oracle Helidon, specifically within its Imperative Web Server component. Helidon is an open-source, lightweight
Hydra is a framework developed by Facebook Research for elegantly configuring complex applications. The vulnerability identified as CVE-2026-68508 resides within
CVE-2026-73899 is a vulnerability in the Helidon product of Oracle Fusion Middleware, specifically within the Imperative Web Server component. Helidon
The openapi3filter component of kin-openapi suffers from an uncontrolled resource consumption vulnerability that allows any unauthenticated client to trigger massive
CVE-2026-76904 is a critical unauthenticated SQL injection vulnerability discovered in the GeoTools open-source Java library, which is widely used by
The vulnerability identified as CVE-2026-73894 resides in the Helidon product of Oracle Fusion Middleware, specifically within its Imperative Web Server
Intro The vulnerability exists in the way the FeatureEventFormatterMd class in Unleash handles Mustache template rendering for outgoing notifications. The
CVE-2026-73898 resides in the Imperative Web Server component of Oracle’s Helidon framework, specifically affecting version 4.5.0. Helidon is a modern
CVE-2026-73900 is a vulnerability identified in the Helidon product of Oracle Fusion Middleware, specifically within the Imperative Web Server component.
The vulnerability exists in Atlantis versions 0.19.8 up to but not including 0.45.0. Atlantis is a widely adopted open-source tool
The vulnerability stems from improper initialization of GPU resource objects within Chrome’s renderer process prior to version 151.0.7922.169. In Chromium’s
The vulnerability in YOURLS arises from improper handling of the HTTP Referer header during short URL redirection. When a user
The vulnerability resides in the openapi3filter.ConvertErrors function of the kin-openapi library, which is used to convert validation errors into HTTP
The vulnerability resides in Keystone’s GraphQL API layer, specifically within the `graphql.maxTake` configuration option, which is intended to cap the
Technical Overview Defuddle is an HTML content extraction library designed to clean up and sanitize web pages for use in
CVE-2026-76046 is a high-severity buffer overflow vulnerability discovered within ANGLE (Almost Native Graphics Layer Engine), a graphics library used by
CVE-2026-77414 is a critical arbitrary code execution vulnerability in the JSONata JSON query and transformation language library. The vulnerability affects
The Unleash addon/integration subsystem permits operators to configure webhooks and integrations (Slack, Teams, Datadog, New Relic) with a target URL
CVE-2026-77414 is a critical vulnerability affecting the JSONata JSON query and transformation language library. The flaw resides in the `environment.lookup`
CVE-2026-61021 resides in the Oracle WebCenter Sites component of Oracle Fusion Middleware, specifically affecting versions 12.2.1.4.0 and 14.1.2.0.0. This flaw
This vulnerability resides in the Oracle WebCenter Sites product, a component of Oracle Fusion Middleware used for web content management
How CVE-2026-61017 Works CVE-2026-61017 is a vulnerability in the Oracle WebCenter Sites product, which is a component of Oracle Fusion
Intro CVE-2026-61022 resides in the Oracle WebCenter Sites product, a component of Oracle Fusion Middleware used for web content management.
CVE-2026-33694 is a high-severity vulnerability discovered in Tenable Nessus and Nessus Agent running on Microsoft Windows operating systems. The flaw
This vulnerability resides in the Oracle WebCenter Sites product, a component of Oracle Fusion Middleware. The flaw affects versions 12.2.1.4.0
CVE-2026-61038 resides in the Oracle WebCenter Sites product, a core component of Oracle Fusion Middleware used for web content management
CVE-2026-61029 targets the Oracle WebCenter Sites component within Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability stems from
CVE-2026-61008 is a critical vulnerability identified in Oracle WebCenter Sites, a component of Oracle Fusion Middleware. The flaw affects versions
CVE-2025-15621 is a medium-severity vulnerability identified in Sparx Systems Pty Ltd.’s Sparx Enterprise Architect, a commercial closed-source UML modeling tool
CVE-2026-61040 is a critical vulnerability discovered in Oracle WebCenter Sites, a core component of Oracle Fusion Middleware used for web
CVE-2026-60682 is a vulnerability in the Oracle Hyperion Financial Reporting product, specifically within its Repository component. The vulnerability arises from
CVE-2026-60753 resides within the Installation component of Oracle Siebel CRM Deployment, affecting versions 17.0 through 26.6. The core issue stems
CVE-2026-60707 resides within the Security component of Oracle Identity Manager (OIM). This vulnerability affects two major version streams: 12.2.1.4.0 and
CVE-2026-61007 is an unauthenticated, network-based high-severity vulnerability in Oracle WebCenter Sites, a component of Oracle Fusion Middleware. The flaw affects
CVE-2026-61018 describes a critical vulnerability residing in Oracle WebCenter Sites. This component belongs to the Oracle Fusion Middleware product family.
CVE-2026-73570 is a pre-authentication remote code execution vulnerability affecting Zimbra Collaboration Suite (ZCS) versions prior to 10.1.20. The flaw resides
CVE-2026-65918 is a memory corruption vulnerability affecting PyTorch torchvision, a popular computer vision library for Python. The flaw resides in
Wagtail CMS suffers from an authorization bypass vulnerability in its snippet copy functionality, identified under GitHub Security Advisory GHSA-x5cx-w6p2-mxf2. The
The CVE-2026-74936 vulnerability resides in the interaction between the JavaScript engine (SpiderMonkey) and the WebAssembly (Wasm) runtime within Mozilla Firefox
js2i18next() is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator (default “) and
The vulnerability identified as CVE-2026-74968 resides within the Graphics: WebRender component of Mozilla Firefox and Thunderbird. WebRender is a GPU‑based
CVE-2026-72529 is a critical vulnerability discovered in TrueConf Server, an on-premises video conferencing platform widely used by enterprises and government
CVE-2026-74940 is a use-after-free vulnerability present in the Graphics: Text component of Mozilla Firefox and Thunderbird. This component is responsible
A flaw was found in Red Hat Quay. A user with `FEATURE_BUILD_SUPPORT` enabled and repository write access can exploit a
CVE-2026-16905 is an improper authentication vulnerability affecting IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The flaw resides
This vulnerability affects Winter CMS, a free, open-source content management system based on the Laravel PHP framework. It allows authenticated
The disclosed vulnerability resides in Winter CMS’s integration of the `wikimedia/less.php` library, which handles dynamic LESS compilation within the backend.
CVE-2026-72530 is a critical code injection vulnerability discovered in TrueConf Server, an on-premises video conferencing platform. The flaw resides in
CVE-2026-17181 is a path traversal vulnerability affecting IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. This security flaw,
The vulnerability identified as CVE-2026-74961 resides within the Web Audio component of Mozilla Firefox, Firefox ESR, and Thunderbird. This flaw
CVE-2026-16915 is a vulnerability identified in IBM Db2 Mirror for i, affecting versions 7.4, 7.5, and 7.6. The core issue
BinaryHttpParser is the component responsible for decoding Binary HTTP (RFC 9292) messages within the Netty incubator codec for OHTTP (Oblivious
This vulnerability resides in Fleet’s activity list endpoints. An authenticated user with read access to Activity could manipulate the `ORDER
How the Vulnerability Works This vulnerability affects Winter CMS versions prior to v1.2.14 and stems from an incomplete patch for
CVE-2026-17175 is an authentication bypass vulnerability affecting IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The flaw stems
CVE-2026-74944 describes a use-after-free vulnerability residing in the DOM: Core & HTML engine, which is shared across Mozilla Firefox, Thunderbird,
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a path traversal vulnerability that allows a remote attacker
The vulnerability resides in the `io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl` package, which implements Oblivious HTTP (RFC 9458) using BoringSSL’s HPKE C library via JNI.
The vulnerability identified as CVE-2026-74943 is a critical use-after-free flaw located in the Graphics: ImageLib component of the Mozilla Firefox
Affected versions of Winter CMS render the `search` query parameter without HTML encoding inside a “ in the query string
CVE-2026-16879 is an improper authorization vulnerability affecting IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The flaw resides
The vulnerability resides in the Binary HTTP parser implementation of the Netty incubator codec for BHTTP (Binary HTTP), specifically in
CVE-2026-17177 is a denial-of-service vulnerability affecting IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The flaw stems from
The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test, but Go’s ServeMux
CVE-2026-17179 is a command injection vulnerability affecting IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The flaw allows
CVE-2026-61827 addresses a critical resource exhaustion vulnerability in the Netty incubator implementation of the Binary HTTP (BHTTP) parser, specifically within
Wagtail is an open-source content management system (CMS) built on Django. A vulnerability has been identified in the document serving
The vulnerability resides in the JavaScript asset processing pipeline of Winter CMS, specifically within the `Winter\Storm\Parse\Assetic\Filter\JavascriptImporter` class. This class is
CVE-2026-17079 is a security bypass vulnerability affecting IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The flaw resides
Affected versions of Winter CMS allow a backend AJAX handler to be invoked by a plain top-level `GET` navigation with
The vulnerability resides in the `Backend\Widgets\Lists::evalImageTypeValue()` method, which is responsible for rendering image columns within backend list widgets. When a
The vulnerability exists in Wagtail’s Documents and Images API V2. Wagtail is a Django-based CMS used for managing web content.
Vulnerability Overview Two endpoints in Fleet’s enterprise tier—responsible for serving in-house iOS application packages (IPA files) and their corresponding manifests—are
Affected versions of Winter CMS failed to enforce the `ImportExportController` behavior’s granular access control on the handlers that actually perform
The vulnerability exists in the `io.netty.incubator:netty-incubator-codec-bhttp` library, specifically within the `BinaryHttpParser` class used for decoding Binary HTTP (BHTTP) messages. The
Mailpit enables SMTP by default and wires `config.MaxMessageSize` into srv.MaxSize. The DATA reader, however, enforces this cap only after reading
The vulnerability arises from a complete absence of object‑level permission validation within the page duplication workflow. When a staff user
