exploit

IBM AIX 7.2 and 7.3, along with IBM PowerVM VIOS 4.1, contain a critical vulnerability that allows a remote attacker

CVE-2026-70921 is a critical vulnerability affecting the Security component of Oracle Hyperion Financial Management (HFM). The flaw exists in version

CVE-2026-70919 is a vulnerability identified in the Security component of Oracle Hyperion Financial Management. The affected release is version 11.2.25.0.000,

CVE-2026-70929 is a critical improper authorization vulnerability identified within the Security component of Oracle Hyperion Financial Management (HFM). The flaw

CVE-2026-70914 addresses a critical security flaw within the Oracle Hyperion Financial Management product, specifically in its Security component. This vulnerability

CVE-2026-70770 resides in the Oracle Warehouse Management component of Oracle E-Business Suite, specifically within the Internal Operations sub-module. This vulnerability

This vulnerability resides in the Security component of Oracle Hyperion Financial Management, a critical application used for financial consolidation and

CVE-2026-70928 is a critical SQL injection vulnerability affecting the Oracle Hyperion Financial Management (HFM) product, specifically within its Security component.

CVE-2026-70754 details a critical oversight in Oracle Hyperion Financial Reporting. The vulnerability resides within the Server component of the product.

Vulnerability Deep Dive CVE-2026-70753 is a vulnerability identified in the Oracle Hyperion Financial Reporting product, specifically within its Server component.

CVE-2026-70920 is a critical vulnerability identified in the Security component of Oracle Hyperion Financial Management (HFM). The affected version is

CVE-2026-70769 is a vulnerability identified in the Oracle Hyperion Financial Reporting product, specifically within its Server component. The affected version

CVE-2026-61302 is a critical security flaw identified in Oracle Business Intelligence Enterprise Edition (BI EE), specifically targeting the Pod Admin

CVE-2026-16864 is a critical stack-based buffer overflow vulnerability affecting IBM AIX versions 7.2 and 7.3, as well as IBM PowerVM

CVE-2026-70911 is a vulnerability identified in the Oracle Hyperion Financial Management product, specifically within its Security component. The affected version

The Phalcon Volt template compiler contains a critical vulnerability in its join filter implementation. The compiler generates PHP code by

CVE-2026-71110 is a high-severity vulnerability affecting Oracle Helidon, a microservices framework within Oracle Fusion Middleware. The flaw resides in the

The disclosed vulnerability resides in the Imperative Web Server component of Oracle Helidon version 4.5.0, part of the Oracle Fusion

CVE-2026-76041 is a high-severity information disclosure vulnerability identified in Google Chrome’s Skia graphics engine. Skia is an open-source 2D graphics

The vulnerability exists in the Unleash OSS server’s request-validation error handling, specifically within the shared error formatting path. An unauthenticated

CVE-2026-73939 is a high-severity vulnerability affecting the Helidon product of Oracle Fusion Middleware, specifically within its Imperative Web Server component.

CVE-2026-76039 describes a critical logic flaw residing in the reference resolution mechanism within the Core component of Google Chrome for

CVE-2026-73892 is a vulnerability identified in the Helidon product of Oracle Fusion Middleware, specifically within its Imperative Web Server component.

Grav CMS versions 2.0.0 through 2.0.19 contain a critical vulnerability that allows authenticated users with page-edit privileges to execute arbitrary

CVE-2026-73893 is a vulnerability identified in Oracle Helidon, specifically within its Imperative Web Server component. Helidon is an open-source, lightweight

Hydra is a framework developed by Facebook Research for elegantly configuring complex applications. The vulnerability identified as CVE-2026-68508 resides within

CVE-2026-73899 is a vulnerability in the Helidon product of Oracle Fusion Middleware, specifically within the Imperative Web Server component. Helidon

The openapi3filter component of kin-openapi suffers from an uncontrolled resource consumption vulnerability that allows any unauthenticated client to trigger massive

CVE-2026-76904 is a critical unauthenticated SQL injection vulnerability discovered in the GeoTools open-source Java library, which is widely used by

The vulnerability identified as CVE-2026-73894 resides in the Helidon product of Oracle Fusion Middleware, specifically within its Imperative Web Server

Intro The vulnerability exists in the way the FeatureEventFormatterMd class in Unleash handles Mustache template rendering for outgoing notifications. The

CVE-2026-73898 resides in the Imperative Web Server component of Oracle’s Helidon framework, specifically affecting version 4.5.0. Helidon is a modern

CVE-2026-73900 is a vulnerability identified in the Helidon product of Oracle Fusion Middleware, specifically within the Imperative Web Server component.

The vulnerability exists in Atlantis versions 0.19.8 up to but not including 0.45.0. Atlantis is a widely adopted open-source tool

The vulnerability stems from improper initialization of GPU resource objects within Chrome’s renderer process prior to version 151.0.7922.169. In Chromium’s

The vulnerability in YOURLS arises from improper handling of the HTTP Referer header during short URL redirection. When a user

The vulnerability resides in the openapi3filter.ConvertErrors function of the kin-openapi library, which is used to convert validation errors into HTTP

The vulnerability resides in Keystone’s GraphQL API layer, specifically within the `graphql.maxTake` configuration option, which is intended to cap the

Technical Overview Defuddle is an HTML content extraction library designed to clean up and sanitize web pages for use in

CVE-2026-76046 is a high-severity buffer overflow vulnerability discovered within ANGLE (Almost Native Graphics Layer Engine), a graphics library used by

CVE-2026-77414 is a critical arbitrary code execution vulnerability in the JSONata JSON query and transformation language library. The vulnerability affects

The Unleash addon/integration subsystem permits operators to configure webhooks and integrations (Slack, Teams, Datadog, New Relic) with a target URL

CVE-2026-77414 is a critical vulnerability affecting the JSONata JSON query and transformation language library. The flaw resides in the `environment.lookup`

CVE-2026-61021 resides in the Oracle WebCenter Sites component of Oracle Fusion Middleware, specifically affecting versions 12.2.1.4.0 and 14.1.2.0.0. This flaw

This vulnerability resides in the Oracle WebCenter Sites product, a component of Oracle Fusion Middleware used for web content management

How CVE-2026-61017 Works CVE-2026-61017 is a vulnerability in the Oracle WebCenter Sites product, which is a component of Oracle Fusion

Intro CVE-2026-61022 resides in the Oracle WebCenter Sites product, a component of Oracle Fusion Middleware used for web content management.

CVE-2026-33694 is a high-severity vulnerability discovered in Tenable Nessus and Nessus Agent running on Microsoft Windows operating systems. The flaw

This vulnerability resides in the Oracle WebCenter Sites product, a component of Oracle Fusion Middleware. The flaw affects versions 12.2.1.4.0

CVE-2026-61038 resides in the Oracle WebCenter Sites product, a core component of Oracle Fusion Middleware used for web content management

CVE-2026-61029 targets the Oracle WebCenter Sites component within Oracle Fusion Middleware, specifically versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability stems from

CVE-2026-61008 is a critical vulnerability identified in Oracle WebCenter Sites, a component of Oracle Fusion Middleware. The flaw affects versions

CVE-2025-15621 is a medium-severity vulnerability identified in Sparx Systems Pty Ltd.’s Sparx Enterprise Architect, a commercial closed-source UML modeling tool

CVE-2026-61040 is a critical vulnerability discovered in Oracle WebCenter Sites, a core component of Oracle Fusion Middleware used for web

CVE-2026-60682 is a vulnerability in the Oracle Hyperion Financial Reporting product, specifically within its Repository component. The vulnerability arises from

CVE-2026-60753 resides within the Installation component of Oracle Siebel CRM Deployment, affecting versions 17.0 through 26.6. The core issue stems

CVE-2026-60707 resides within the Security component of Oracle Identity Manager (OIM). This vulnerability affects two major version streams: 12.2.1.4.0 and

CVE-2026-61007 is an unauthenticated, network-based high-severity vulnerability in Oracle WebCenter Sites, a component of Oracle Fusion Middleware. The flaw affects

CVE-2026-61018 describes a critical vulnerability residing in Oracle WebCenter Sites. This component belongs to the Oracle Fusion Middleware product family.

CVE-2026-73570 is a pre-authentication remote code execution vulnerability affecting Zimbra Collaboration Suite (ZCS) versions prior to 10.1.20. The flaw resides

CVE-2026-65918 is a memory corruption vulnerability affecting PyTorch torchvision, a popular computer vision library for Python. The flaw resides in

Wagtail CMS suffers from an authorization bypass vulnerability in its snippet copy functionality, identified under GitHub Security Advisory GHSA-x5cx-w6p2-mxf2. The

The CVE-2026-74936 vulnerability resides in the interaction between the JavaScript engine (SpiderMonkey) and the WebAssembly (Wasm) runtime within Mozilla Firefox

js2i18next() is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator (default “) and

The vulnerability identified as CVE-2026-74968 resides within the Graphics: WebRender component of Mozilla Firefox and Thunderbird. WebRender is a GPU‑based

CVE-2026-72529 is a critical vulnerability discovered in TrueConf Server, an on-premises video conferencing platform widely used by enterprises and government

CVE-2026-74940 is a use-after-free vulnerability present in the Graphics: Text component of Mozilla Firefox and Thunderbird. This component is responsible

A flaw was found in Red Hat Quay. A user with `FEATURE_BUILD_SUPPORT` enabled and repository write access can exploit a

CVE-2026-16905 is an improper authentication vulnerability affecting IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The flaw resides

This vulnerability affects Winter CMS, a free, open-source content management system based on the Laravel PHP framework. It allows authenticated

The disclosed vulnerability resides in Winter CMS’s integration of the `wikimedia/less.php` library, which handles dynamic LESS compilation within the backend.

CVE-2026-72530 is a critical code injection vulnerability discovered in TrueConf Server, an on-premises video conferencing platform. The flaw resides in

CVE-2026-17181 is a path traversal vulnerability affecting IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. This security flaw,

The vulnerability identified as CVE-2026-74961 resides within the Web Audio component of Mozilla Firefox, Firefox ESR, and Thunderbird. This flaw

CVE-2026-16915 is a vulnerability identified in IBM Db2 Mirror for i, affecting versions 7.4, 7.5, and 7.6. The core issue

BinaryHttpParser is the component responsible for decoding Binary HTTP (RFC 9292) messages within the Netty incubator codec for OHTTP (Oblivious

This vulnerability resides in Fleet’s activity list endpoints. An authenticated user with read access to Activity could manipulate the `ORDER

How the Vulnerability Works This vulnerability affects Winter CMS versions prior to v1.2.14 and stems from an incomplete patch for

CVE-2026-17175 is an authentication bypass vulnerability affecting IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The flaw stems

CVE-2026-74944 describes a use-after-free vulnerability residing in the DOM: Core & HTML engine, which is shared across Mozilla Firefox, Thunderbird,

IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 contain a path traversal vulnerability that allows a remote attacker

The vulnerability resides in the `io.netty.incubator:netty-incubator-codec-ohttp-hpke-classes-boringssl` package, which implements Oblivious HTTP (RFC 9458) using BoringSSL’s HPKE C library via JNI.

The vulnerability identified as CVE-2026-74943 is a critical use-after-free flaw located in the Graphics: ImageLib component of the Mozilla Firefox

Affected versions of Winter CMS render the `search` query parameter without HTML encoding inside a “ in the query string

CVE-2026-16879 is an improper authorization vulnerability affecting IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The flaw resides

The vulnerability resides in the Binary HTTP parser implementation of the Netty incubator codec for BHTTP (Binary HTTP), specifically in

CVE-2026-17177 is a denial-of-service vulnerability affecting IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The flaw stems from

The cross-site WebSocket hijacking fix was reimplemented as an origin check gated on a raw-URI prefix test, but Go’s ServeMux

CVE-2026-17179 is a command injection vulnerability affecting IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The flaw allows

CVE-2026-61827 addresses a critical resource exhaustion vulnerability in the Netty incubator implementation of the Binary HTTP (BHTTP) parser, specifically within

Wagtail is an open-source content management system (CMS) built on Django. A vulnerability has been identified in the document serving

The vulnerability resides in the JavaScript asset processing pipeline of Winter CMS, specifically within the `Winter\Storm\Parse\Assetic\Filter\JavascriptImporter` class. This class is

CVE-2026-17079 is a security bypass vulnerability affecting IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6. The flaw resides

Affected versions of Winter CMS allow a backend AJAX handler to be invoked by a plain top-level `GET` navigation with

The vulnerability resides in the `Backend\Widgets\Lists::evalImageTypeValue()` method, which is responsible for rendering image columns within backend list widgets. When a

The vulnerability exists in Wagtail’s Documents and Images API V2. Wagtail is a Django-based CMS used for managing web content.

Vulnerability Overview Two endpoints in Fleet’s enterprise tier—responsible for serving in-house iOS application packages (IPA files) and their corresponding manifests—are

Affected versions of Winter CMS failed to enforce the `ImportExportController` behavior’s granular access control on the handlers that actually perform

The vulnerability exists in the `io.netty.incubator:netty-incubator-codec-bhttp` library, specifically within the `BinaryHttpParser` class used for decoding Binary HTTP (BHTTP) messages. The

Mailpit enables SMTP by default and wires `config.MaxMessageSize` into srv.MaxSize. The DATA reader, however, enforces this cap only after reading