Sign in Get started free

loading

Every new threat · Live · InfraStack

Sign in Get started free

Live· 1,996 threats · Tuesday, Oct 20· last check 2026-11-04 07:20 UTC

Everything we’re watching.

Every new vulnerability, vendor incident and attack on AI tools, merged from every source as it lands. Early warnings before a CVE exists.

On fire Needs attention Early warnings Everything

Tuesday, Oct 20

Most severe in everything

EXPLOITED IN THE WILD

FooSun DotNetCMS: unauthenticated SQL injection leaks database contentsDotNetCMS

EXPLOITED IN THE WILD

EyeLock nano NXT: unauthenticated path traversal reads arbitrary local filesEyeLock nano NXT

Oracle JD Edwards EnterpriseOne Orchestrator: unauthenticated network takeover flawJD Edwards EnterpriseOne Orchestrator

Oracle SOA Suite Adapters: unauthenticated network takeover of the server

Tuesday, Oct 20

NOT SCOREDNOT SCOREDCVE-2026-6945 was rejected and withdrawn by its CVE Numbering AuthorityOther2026-10-20 23:17 UTCby NVD–WHAT TO DO MEDIUM6.9a2a-rs: error handling in a2a-server leaks information to remote callersPackage2026-10-20 23:17 UTCby EPSS–WHAT TO DO LOWNOT SCOREDPerl Imager::File::GIF: out-of-bounds read leaks heap memory from crafted GIFPackage2026-10-20 11:42 UTCby EPSS–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ssemver (PyPI)ssemverPackage2026-10-20 23:02 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in semer (PyPI)semerPackage2026-10-20 23:02 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in debbug (PyPI)debbugPackage2026-10-20 23:01 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in deebug (PyPI)deebugPackage2026-10-20 22:59 UTCby osv-malicious–UNINSTALL LOW3.7IBM Cyber Fraud: session cookies sent over unencrypted connectionsOther2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM6.1IBM Carbon Charts: MeterChart titles let attackers run script in browsersPackage2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH7.8IBM Sterling Connect Direct: apnotify utility code injection on UnixOther2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM6.5IBM i Navigator: unauthenticated HTTP request can alter session security stateInfrastructure2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH8.2IBM QRadar SIEM: out-of-bounds read enables denial of service or data leakInfrastructure2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH8.6IBM QRadar SIEM: remote attacker can exhaust resources and cause denial of serviceIBM QRadar SIEM HTTP Receiver protocolInfrastructure2026-10-20 22:21 UTCby InfraStack Analyst–FIX 7.5-20260930064859 CRITICAL9.8IBM App Connect Enterprise: unrestricted bind leaks sensitive data to remote attackersIBM App Connect EnterpriseVendor2026-10-20 22:21 UTCby InfraStack Analyst–FIX 13.0.9.0 HIGH8.8Oracle Data Integrator: low-privilege SQL attack takes over the productOracle Data IntegratorOther2026-10-20 22:21 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8Oracle Essbase: unauthenticated network flaw allows full takeover of serveroracle essbaseVendor2026-10-20 22:21 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5Oracle Essbase: unauthenticated network request can crash the serveroracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO CRITICAL9.9Oracle Essbase: low-privilege network attacker can take over the serveroracle essbaseInfrastructure2026-10-20 22:21 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.4Oracle Essbase: Java Based Agent flaw exposes data to low-privilege local usersoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH7.7Oracle Essbase: low-privilege HTTP attacker can read critical dataoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM4.3Oracle Essbase: low-privilege HTTP request can partly deny serviceoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH7.7Oracle Essbase Build component flaw exposes critical data over HTTPoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO CRITICAL9.9Oracle Essbase: low-privileged HTTP user can take over the serveroracle essbaseVendor2026-10-20 22:21 UTCby InfraStack Analyst–WHAT TO DO MEDIUM4.3Oracle Essbase: low-privilege HTTP user can read a subset of dataoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO CRITICAL9.1Oracle Essbase: low-privilege network user can read and alter dataoracle essbaseOther2026-10-20 22:21 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1Oracle Essbase: low-privilege HTTP user can access, change, or disrupt dataoracle essbaseRuntime2026-10-20 22:21 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.3Oracle Essbase: low-privilege HTTP attacker can read, change and disrupt dataoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH8.5Oracle Essbase: low-privilege web flaw exposes critical data over HTTPoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM5.0Oracle Essbase: low-privilege network user can read a subset of dataoracle essbaseOther2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH8.5Oracle Essbase: Web Platform flaw lets low-privileged users take over serveroracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO LOW3.7Oracle Essbase: Java Based Agent flaw leaks a subset of dataoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM6.0Oracle Essbase: Java Based Agent flaw exposes data to high-privilege local usersoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Essbase: unauthenticated network attacker can read a subset of dataoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH8.1Oracle Essbase: unauthenticated network flaw allows full takeover of serveroracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM5.6Oracle Essbase: unauthenticated network flaw exposes some data and partial denial of serviceoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Essbase: unauthenticated HTTP request reads a subset of dataoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO CRITICAL9.3Oracle Essbase: unauthenticated network attacker can read and alter dataoracle essbaseRuntime2026-10-20 22:21 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.3Oracle Essbase: Java Based Agent flaw leaks a subset of dataoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH7.3Oracle Essbase: unauthenticated HTTP flaw allows data change and partial denial of serviceoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM5.0Oracle Essbase: low-privileged network user can read a subset of dataoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM5.0Oracle Essbase: low-privilege network attacker reads a subset of dataoracle essbaseOther2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH7.7Oracle Essbase: low-privileged HTTP attacker gains access to critical dataoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO CRITICAL9.9Oracle Essbase: low-privilege HTTP request lets attackers take over serveroracle essbaseOther2026-10-20 22:21 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.9Oracle Essbase: low-privilege network attacker can take over serveroracle essbaseOther2026-10-20 22:21 UTCby InfraStack Analyst–WHAT TO DO HIGH7.7Oracle Essbase: low-privilege HTTP attacker gains access to all accessible dataoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH8.1Oracle Essbase: unauthenticated network attacker can take over the serveroracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Essbase: unauthenticated network attacker can read a subset of dataoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM6.0Oracle Essbase: local high-privilege attacker can read critical dataoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH7.7Oracle Essbase: low-privileged HTTP attacker can access critical dataoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM5.0Oracle Essbase: low-privilege network attacker reads a subset of dataoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM6.8Oracle Essbase: Security component flaw exposes critical data to privileged attackersoracle essbaseVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM4.7Oracle Billing and Revenue Management: low-privileged local user reads critical dataVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM5.5Oracle BRM Server: low-privilege local user can read critical billing dataVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH7.8Oracle Billing and Revenue Management: local low-privilege user can take overVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH8.2Oracle Agile PLM for Process: unauthenticated HTTP flaw exposes critical dataVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO CRITICAL9.1Oracle Agile PLM for Process: unauthenticated network flaw lets attackers alter dataOracle Agile Product Lifecycle Management for ProcessOther2026-10-20 22:21 UTCby InfraStack Analyst–WHAT TO DO HIGH7.4Oracle Agile PLM for Process: unauthenticated HTTP flaw exposes critical dataVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO CRITICAL9.3Oracle Agile PLM: unauthenticated attacker can modify and delete critical dataOracle Agile Product Lifecycle Management for ProcessOther2026-10-20 22:21 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.5Oracle Middleware Remote Diagnostic Agent: low-privilege local user reads critical dataVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO LOW3.7Oracle Middleware: Remote Diagnostic Agent flaw leaks some readable dataVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM6.3Oracle Database: Java VM flaw lets low-privileged users change dataVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO LOW3.3Oracle Unified Inventory Management: local low-privilege user reads some dataVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO LOW3.3Oracle Unified Inventory Management: local low-privilege user reads some dataVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO LOW3.3Oracle Unified Inventory Management: local low-privilege user reads some dataVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH8.8Oracle REST Data Services: low-privilege HTTP user can take over serverOracle REST Data ServicesRuntime2026-10-20 22:21 UTCby InfraStack Analyst–FIX 26.2.3 MEDIUM6.5Oracle REST Data Services: GraphQL flaw exposes data to low-privilege usersRuntime2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH7.5Oracle BI Publisher: unauthenticated HTTP flaw exposes all accessible dataVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM4.3Oracle Business Intelligence: low-privilege network attacker reads a subset of dataVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH7.5Oracle Agile PLM for Process: flaw lets low-privileged users take over the productPackage2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM4.3Oracle Business Intelligence: Visual Analyzer flaw exposes a subset of dataPackage2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM4.3Oracle Business Intelligence: Majel Mobile Service flaw exposes some stored dataVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH8.3Oracle Business Intelligence: Platform Security flaw allows takeover from adjacent networkVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM5.4Oracle BI Publisher: Web Service API flaw exposes some data to low-privilege usersVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle BI Enterprise Edition: BI Search flaw lets unauthenticated attackers change dataVendor2026-10-20 22:21 UTCby EPSS–WHAT TO DO LOW3.7Oracle Business Intelligence: BI Search flaw allows partial denial of serviceOther2026-10-20 22:21 UTCby EPSS–WHAT TO DO HIGH8.8Oracle BI Publisher: unauthenticated network flaw allows full takeoverOracle BI PublisherOther2026-10-20 22:21 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.4Oracle Business Intelligence: low-privilege users can read and change some dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Business Intelligence: low-privilege HTTP attacker can read critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle BI Publisher: low-privilege HTTP attacker can read critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.2Oracle Agile PLM for Process: unauthenticated HTTP flaw exposes and alters dataOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.7Oracle Database: low-privileged session user can read critical RDBMS dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.4Oracle Agile PLM for Process: low-privilege network flaw exposes critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle Database OLAP: low-privilege user with DBMS_AW can take overOracle Database ServerPackage2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO MEDIUM4.4Oracle PeopleSoft FIN Inventory Brazil: low-privilege users can alter data and degrade serviceVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.4Oracle PeopleSoft FIN Manufacturing Brazil: Integration flaw lets local users alter dataOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.0Oracle Business Intelligence Enterprise Edition: local low-privilege takeover via BI FoundationOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.1Oracle BI Publisher: web server flaw allows unauthenticated data read and changeVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle BI Publisher 12.2.1.4.0: unauthenticated HTTP flaw exposes and alters some dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.4Oracle PeopleSoft FIN Product Configurator Brazil: low-privilege users can alter dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle WebCenter Sites: unauthenticated HTTP flaw exposes all stored dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle Agile PLM for Process: low-privilege network user can take over serverOracle Agile Product Lifecycle Management for ProcessOther2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO HIGH7.8Oracle Business Intelligence: local flaw lets attacker take over the serverPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.5Oracle GoldenGate: Vendor Access Module flaw exposes data to low-privilege local usersOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.1Oracle Business Intelligence: unauthenticated HTTP flaw allows full takeoverVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.8Oracle Business Intelligence: Platform Security flaw allows full takeover after user actionVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle WebCenter Sites: unauthenticated HTTP flaw exposes critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle PeopleSoft FIN Common Objects Brazil: unauthenticated HTTP flaw allows data changesVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.8Oracle Business Intelligence: Presentation Services flaw lets local users take overVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.8Oracle Solaris 11.4: Utility flaw lets a local user take over the systemInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.0Oracle SOA Suite Fabric Layer flaw lets low-privilege users change dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle Business Intelligence: BI Search flaw lets low-privileged users take over serverOracle Business Intelligence Enterprise EditionPackage2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO HIGH8.6Oracle Business Intelligence: unauthenticated web flaw allows data read, change and crashOracle Business Intelligence Enterprise EditionVendor2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU patch (number unknown)HIGH8.8Oracle E-Business Suite: Applications Manager flaw lets low-privilege users take overOracle E-Business Suite (Applications Manager)Package2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU (patch 40022426, per Rapid7, unconfirmed)MEDIUM4.4Oracle GoldenGate: Admin Client flaw exposes data to high-privilege network attackersPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.3Oracle BI Publisher 12.2.1.4.0: low-privilege users can read some dataPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle ZFS Storage Appliance Kit: low-privilege network user can take over applianceOracle ZFS Storage Appliance KitInfrastructure2026-10-20 22:20 UTCby InfraStack Analyst–FIX unknown - likely OS8.8.96, unconfirmed MEDIUM4.7Oracle BI Publisher web server flaw allows limited data read and changeVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.3Oracle Business Intelligence: low-privilege HTTP request causes partial denial of servicePackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.4Oracle Business Intelligence: web flaw lets low-privilege users read and change dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle Agile PLM for Process: low-privilege network attacker takes over serverOracle Agile Product Lifecycle Management for ProcessPackage2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8Oracle Agile PLM for Process: low-privilege HTTP attacker can take over serverOracle Agile Product Lifecycle Management for ProcessPackage2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU patch (id in MOS note)MEDIUM6.5Oracle PeopleSoft PeopleTools: Report Distribution flaw exposes data to low-privileged usersVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.4Oracle BI Publisher: low-privilege users can read and change some dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.0Oracle GoldenGate Management Pack EM Plugin: unauthenticated takeover from adjacent networkOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle Agile PLM for Process: Product Quality Management flaw allows full takeoverVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle BI Publisher: low-privilege web flaw exposes critical dataPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.2Oracle Agile PLM for Process: high-privilege HTTP flaw allows full takeoverVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.1Oracle E-Business Suite Purchasing: low-privilege network attack exposes critical dataOracle E-Business Suite (Purchasing, Internal Operations)Vendor2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU patch (number in MOS)HIGH8.1Oracle E-Business Suite Workflow: unauthenticated network takeover via Notification MailerOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.0Oracle PeopleSoft PeopleTools: porting component flaw exposes stored data to adminsOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle WebCenter Content: flaw in Content Portal Suite allows full takeoverRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.1Oracle Database: VPD flaw lets low-privileged users modify protected dataPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.3Oracle WebLogic Server: unauthenticated network flaw allows data changes and partial denial of serviceRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.5Oracle Identity Manager installer flaw exposes data to local low-privilege usersVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle Database: low-privilege DBMS_VECTOR user can take over RDBMSRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle PeopleSoft PeopleTools: unauthenticated HTTP flaw allows limited data changesOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle E-Business Suite: Workflow Notification Mailer flaw allows takeover over HTTPPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO CRITICAL9.8Oracle WebCenter Content: unauthenticated HTTP takeover of Content ServerOracle WebCenter ContentVendor2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU patch (number in MOS)HIGH7.4Oracle Identity Manager Connector: LDAP Gateway flaw lets unauthenticated network attackers modify dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle Identity Manager Connector: LDAP Gateway flaw exposes data to unauthenticated attackersVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.7Oracle Identity Manager Connector: unauthenticated HTTP flaw exposes SAP ERP dataOracle Identity Manager ConnectorVendor2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8Oracle Identity Manager LDAP Gateway flaw lets unauthenticated attackers take overOracle Identity Manager ConnectorOther2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1Oracle Identity Manager Connector: unauthenticated LDAP flaw exposes and alters dataOracle Identity Manager ConnectorVendor2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO HIGH7.1Oracle Identity Manager Connector: LDAP Gateway flaw lets local users read and change dataOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.1Oracle Identity Manager Connector: Generic REST flaw lets low-privileged users modify dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.8Oracle Java SE Compiler flaw lets unauthenticated network attackers change some dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.4Oracle PeopleSoft FIN General Ledger Brazil: low-privilege user can alter dataOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.8Oracle PeopleSoft Cash Management: high-privilege local attacker can alter some dataPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Java SE: plugin flaw lets low-privilege users escape the sandboxRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.8Oracle Outside In: local flaw lets a logged-in attacker take over the productPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle PeopleSoft Strategic Sourcing: Bidder Registration exposes data to low-privilege usersVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.4Oracle PeopleSoft SCM Purchasing: Supplier Registration flaw exposes data to attackersVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle PeopleSoft Strategic Sourcing: low-privilege users can read critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Database Server: unauthenticated attacker can crash RDBMS via adjacent networkPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle PeopleSoft Strategic Sourcing: low-privilege network user can take overPeopleSoft Enterprise SCM Strategic SourcingVendor2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO LOW3.1Oracle JavaFX: unauthenticated network attacker can read a subset of dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle PeopleSoft FIN Common Objects Brazil: unauthenticated read of some dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.6Oracle Outside In Clean Content SDK: local low-privilege user can modify dataPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.1Oracle PeopleSoft FIN Common Objects Brazil: high-privilege attacker can modify critical dataPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.8Oracle HTTP Server: local low-privilege user can take over the serverOracle HTTP ServerRuntime2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO LOW3.7Oracle PeopleSoft: BAM Framework flaw allows limited data changes over HTTPVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle PeopleSoft PeopleTools: unauthenticated HTTP flaw allows data changes and partial denial of servicePackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.6Oracle Fusion Middleware Control: framework flaw allows takeover with physical accessRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.4Oracle PeopleSoft FIN Common Objects Argentina: Asset Management flaw allows data changesVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle PeopleSoft FIN Common Objects Argentina: unauthenticated network access to dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Java SE: JGSS flaw exposes data to untrusted-code attackersRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Java SE: JGSS flaw exposes data to unauthenticated network attackersRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.9Oracle Java SE: JGSS flaw lets remote attacker alter dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.7Oracle Java SE JSSE: TLS flaw lets unauthenticated network attacker modify some dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.8Oracle Outside In: Image Export SDK flaw enables full takeover locallyVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.8Oracle Outside In: image export SDK flaw lets local attacker take overOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.8Oracle Outside In: local flaw lets a user take over the componentPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.8Oracle Outside In: Image Export SDK flaw lets local attacker take overPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.4Oracle JD Edwards EnterpriseOne Tools: unauthenticated HTTP flaw allows data read and changeVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Java SE: Lightweight HTTP Server flaw allows unauthorized data changesRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Java SE: networking flaw lets unauthenticated attackers alter some dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Java SE: Networking flaw lets unauthenticated remote users alter some dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.4Oracle Siebel CRM: unauthenticated network flaw exposes and changes CRM dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.4Oracle Siebel CRM: unauthenticated HTTP flaw exposes and changes CRM dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle Siebel CRM Deployment: unauthenticated HTTP flaw exposes critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle Siebel CRM Deployment: unauthenticated HTTP flaw exposes critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.7Oracle Siebel CRM Deployment: local high-privilege user can take over serverVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.2Oracle Siebel CRM End User: unauthenticated HTTP flaw exposes and alters customer dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.7Oracle Siebel CRM Deployment: local high-privilege flaw allows full takeoverOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Siebel CRM Deployment: low-privilege HTTP attacker reads critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle Siebel CRM Deployment: low-privileged HTTP user can take over serverSiebel CRM DeploymentPackage2026-10-20 22:20 UTCby InfraStack Analyst–FIX see Oracle CPU Oct 2026 (26.10 per Armis, unconfirmed)MEDIUM6.5Oracle Siebel Order Management: low-privilege HTTP flaw allows data changes and readsVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Siebel CRM: unauthenticated HTTP flaw exposes and alters some CRM dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.5Oracle Siebel CRM Deployment: low-privileged local user reads critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.1Oracle Siebel CRM Deployment: low-privilege HTTP flaw exposes and alters CRM dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.7Oracle Siebel CRM: network flaw lets privileged user change critical dataSiebel CRM DeploymentVendor2026-10-20 22:20 UTCby InfraStack Analyst–FIX see Oracle CPU Oct 2026 (a release after 26.9; 26.10 per Armis, unconfirmed)LOW3.9Oracle Siebel CRM Deployment: local high-privilege flaw exposes some dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Siebel CRM: low-privileged HTTP request can crash the serverVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.7Oracle Siebel CRM Deployment: local high-privilege user can take over serverVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.2Oracle Siebel Field Service: Smart Answer flaw enables takeover by privileged usersVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Siebel CRM End User: Open UI flaw exposes and alters some dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.5Oracle Siebel CRM End User: low-privilege local flaw exposes critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Siebel Financial Services: unauthenticated HTTP flaw exposes and alters CRM dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Siebel CRM: unauthenticated HTTP flaw exposes and alters CRM dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.3Oracle Siebel CRM End User: Open UI flaw allows limited unauthorized data changesVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW2.3Oracle Siebel CRM Deployment: high-privilege user can partially disrupt serviceVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.5Oracle Siebel CRM Deployment: low-privilege local user reads critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.4Oracle Siebel CRM Deployment: HTTP flaw allows data reads, edits and crashesVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.0Oracle Siebel CRM Deployment: local high-privilege flaw exposes CRM dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Siebel CRM Deployment: low-privilege HTTP flaw allows critical data changesOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.9Oracle Siebel CRM Deployment: unauthenticated HTTP request can hang or crash serverVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Siebel CRM Deployment: low-privilege HTTP user can modify critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.8Oracle HTTP Server: OSSL module flaw lets local users take over serverRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Java SE: ImageIO flaw lets unauthenticated network attackers crash the JVMRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Java SE: CORBA flaw lets unauthenticated network attackers cause partial denial of serviceRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.0Java SE and GraalVM: 2D component flaw enables crash and data accessRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Siebel CRM Deployment: unauthenticated HTTP flaw exposes critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.0Oracle Siebel CRM: scripting flaw lets a privileged user crash or read dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Siebel CRM End User: low-privilege HTTP flaw exposes accessible dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Java SE: JGSS flaw lets unauthenticated network attacker crash or alter dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Java SE: Libraries flaw lets unauthenticated network attacker cause partial denial of serviceRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.7Oracle Java SE Networking flaw lets remote attackers cause partial denial of serviceRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO CRITICAL9.8Oracle Identity Manager: unauthenticated takeover over T3 and IIOPOracle Identity ManagerRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX unknown: October 2026 CPU patch HIGH8.8Oracle Identity Manager REST flaw lets low-privilege users take over serverOracle Identity ManagerVendor2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5Oracle Outside In PDF Export SDK: unauthenticated flaw allows full takeoverPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle Outside In PDF Export SDK: unauthenticated takeover over HTTPPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.0Oracle Outside In: PDF export SDK flaw leaks a subset of dataPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.1Oracle Java SE and JavaFX: sandbox flaw leaks a subset of dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.1Oracle Java SE: Sound component flaw allows partial denial of serviceRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.3Oracle Primavera P6 Web Access: low-privileged users can alter some project dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.8Oracle Java SE: SOCKS5 networking flaw lets unauthenticated attackers modify dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.6Oracle Java SE: serviceability component flaw allows limited data change and partial denial of serviceRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Java SE and GraalVM: network attacker can alter data or cause partial denial of serviceRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Java SE and GraalVM: network attacker can alter data or cause partial denial of serviceRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.9Oracle Java SE: Networking flaw exposes data to unauthenticated network attackersRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.1Oracle Siebel CRM End User: Open UI flaw allows limited data changesVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.7Oracle Siebel CRM End User: Open UI flaw allows limited data changesVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.7Oracle Siebel CRM End User: Open UI flaw leaks some stored dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.4Oracle Siebel CRM End User: Open UI flaw exposes some data to changesVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.4Oracle Siebel CRM End User: Open UI flaw lets low-privilege users change dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.7Oracle Siebel CRM End User: Open UI flaw allows data read and writeVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.4Oracle Siebel CRM End User: Open UI flaw exposes and alters some recordsVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.8Oracle JD Edwards EnterpriseOne Orchestrator: IoT component flaw allows data changesOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.4Java SE JavaFX: untrusted applet or Web Start code can read and change dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle JD Edwards EnterpriseOne Tools: low-privilege network user reads critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.6Oracle JD Edwards EnterpriseOne Tools: privileged attacker can access and change dataOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Java SE: 2D component flaw lets unauthenticated network attackers modify dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.7Oracle Java SE 2D: unauthenticated network flaw lets attacker change some dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.0Oracle Java SE: Utility component flaw lets an attacker change some dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.7Oracle Java SE: JDK tools flaw lets a local attacker alter dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.1Oracle Siebel CRM Integration: Open Integration flaw exposes CRM data over HTTPOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle Siebel CRM Integration: unauthenticated HTTP flaw exposes critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Primavera P6 Web Access flaw exposes project data to low-privilege usersVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.7Oracle Java SE Libraries: local attacker can modify data via untrusted inputRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.8Oracle Java SE: Serviceability flaw lets remote attackers read and change some dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Java SE JSSE: unauthenticated TLS input can partly crash the runtimeRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.3Oracle Siebel CRM Cloud: low-privilege read of some accessible dataOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.8Oracle Siebel CRM Cloud: unauthenticated read access to some CRM dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Siebel CRM Cloud: unauthenticated read of a subset of dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Siebel CRM Cloud: low-privilege users can alter critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.1Oracle Siebel CRM Cloud: Cloud Manager flaw exposes critical data to adminsVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Siebel CRM Cloud: low-privilege infrastructure logon exposes critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.7Oracle Siebel CRM Cloud: adjacent-network flaw allows limited data read and writeVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.9Oracle Siebel CRM Cloud: Cloud Manager flaw exposes data to adjacent-network attackersVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.8Oracle Siebel CRM Cloud: adjacent-network attacker can alter and read dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.7Oracle Siebel CRM Cloud: unauthenticated read of some CRM dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Siebel CRM Cloud: unauthenticated HTTP request reads a subset of dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Siebel CRM Cloud: unauthenticated HTTP flaw allows limited data changesVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Siebel CRM Cloud: low-privileged user can read critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle Siebel CRM Cloud: unauthenticated read of some CRM dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.2Oracle BPM Suite: unauthenticated HTTP flaw exposes critical data in Case ManagementPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle E-Business Suite Order Management: flaw exposes order data to low-privileged usersVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.2Oracle PeopleSoft Global Payroll Switzerland: high-privilege local user can alter dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.4Oracle Outside In: local flaw lets a logged-on user take over the SDKVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO CRITICAL9.9Oracle Outside In: flaw lets low-privilege network attacker take overOracle Outside In Technology (Clean Content SDK)Other2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO HIGH8.6Oracle Outside In Clean Content SDK: unauthenticated network flaw exposes dataOracle Outside In TechnologyPackage2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.3Oracle Outside In Clean Content SDK: unauthenticated HTTP request causes partial denial of servicePackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.1Oracle Outside In Clean Content SDK: low-privilege local flaw allows data modificationPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle Outside In Clean Content SDK: unauthenticated network crash causes denial of servicePackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle Outside In Clean Content SDK: unauthenticated network crash denies servicePackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.4Oracle Solaris Utility flaw lets a local user take over the systemInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.5Oracle E-Business Suite iSupport: low-privileged HTTP attacker can modify dataOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.2Oracle Outside In Clean Content SDK: unauthenticated HTTP flaw exposes dataOracle Outside In Technology (Clean Content SDK)Vendor2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5Oracle Outside In Clean Content SDK: unauthenticated network crash denies servicePackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle Outside In Clean Content SDK: unauthenticated HTTP request crashes servicePackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.6Oracle Outside In: unauthenticated network flaw lets attacker alter critical dataOracle Outside In TechnologyOther2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO HIGH8.2Oracle Outside In Clean Content SDK: unauthenticated HTTP flaw allows data changesVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO CRITICAL9.1Oracle Outside In Content SDK: remote unauthenticated flaw allows tampering and crashesOracle Outside In TechnologyOther2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8Oracle Outside In Clean Content SDK: network flaw lets low-privilege user take overOracle Outside In Technology (Clean Content SDK)Package2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5Oracle E-Business Suite iSupport: low-privileged users can read critical data over HTTPVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.1Oracle E-Business Suite iSupport: low-privileged users can modify and delete dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.4Oracle E-Business Suite iProcurement: unauthenticated flaw lets attackers modify and read dataPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Solaris 11.4: Utility flaw lets local users change protected dataInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW2.6Oracle Java SE AWT flaw leaks a subset of data to remote attackersRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.7Oracle Java SE: ImageIO flaw lets remote attacker read some dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.7Oracle Java SE: flaw lets unauthenticated attacker alter some accessible dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Java SE Networking: unauthenticated network flaw lets attackers alter some dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.8Oracle PeopleSoft: high-privilege HTTP attacker can alter some CC application dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.3Oracle JD Edwards EnterpriseOne Tools: local user can partly disrupt serviceVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle JD Edwards EnterpriseOne Tools: installation security flaw allows data changesVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.8Oracle JD Edwards EnterpriseOne Tools: deployment flaw allows takeover of the productVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle JD Edwards EnterpriseOne Tools: installation flaw allows takeover from adjacent networkPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle JD Edwards EnterpriseOne Tools: adjacent attacker takes over installsJD Edwards EnterpriseOne ToolsOther2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5Oracle JD Edwards EnterpriseOne Tools: unauthenticated network flaw exposes critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.7Oracle Solaris 11.4 Libraries flaw lets local users crash the systemInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO CRITICAL9.8Oracle WebLogic Server: unauthenticated HTTP flaw allows full server takeoverOracle WebLogic ServerRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX PSU 40069416 (12.2.1.4.0)LOW3.3Oracle JDeveloper: low-privilege local user reads a subset of dataPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle iProcurement: Requisition Management flaw lets low-privilege users take overOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.7Oracle JDeveloper: privileged local user can modify data or crash IDEPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.9Oracle JDeveloper: Java Business Objects flaw allows unauthenticated data modification over HTTPRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle JDeveloper: Security Framework flaw exposes data to unauthenticated network attackersPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.9Oracle JDeveloper: ADF Databinding flaw exposes data over SOAPPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.2Oracle E-Business Suite iProcurement: high-privilege network attacker can take overRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.8Oracle JD Edwards EnterpriseOne Tools: installation flaw enables takeover of the productVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.8Oracle JD Edwards EnterpriseOne Tools: installation security flaw allows takeoverVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.1Oracle JD Edwards EnterpriseOne Tools: installation flaw allows unauthenticated takeoverVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle JD Edwards EnterpriseOne Tools: installation security flaw exposes critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.8Oracle JD Edwards EnterpriseOne Tools: local low-privilege user can take overPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle JD Edwards EnterpriseOne Tools: low-privileged network user can take overJD Edwards EnterpriseOne ToolsVendor2026-10-20 22:20 UTCby InfraStack Analyst–FIX 9.2.26.6 MEDIUM5.9Oracle JD Edwards EnterpriseOne Tools: flaw lets unauthenticated network attackers reach dataOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle JD Edwards EnterpriseOne Tools: unauthenticated network access to critical dataOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle JD Edwards EnterpriseOne Tools: unauthenticated network access to dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.8Oracle JD Edwards EnterpriseOne Tools: local low-privilege takeover via installation securityPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO CRITICAL9.1Oracle JD Edwards EnterpriseOne Tools: unauthenticated network attacker reads and changes dataJD Edwards EnterpriseOne ToolsVendor2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO HIGH7.8Oracle JD Edwards EnterpriseOne Tools: installation security flaw allows takeoverVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle JD Edwards EnterpriseOne Tools: installation flaw enables full takeover over HTTPVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.3Oracle JD Edwards EnterpriseOne Tools: local partial denial of serviceVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.6Oracle JD Edwards EnterpriseOne Tools: low-privilege local user can alter dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.1Oracle JD Edwards EnterpriseOne Tools: Web Runtime flaw allows limited data changesPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO CRITICAL10.0Oracle JD Edwards EnterpriseOne Orchestrator: unauthenticated network takeover flawJD Edwards EnterpriseOne OrchestratorOther2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.4Oracle JD Edwards EnterpriseOne Tools: web runtime flaw exposes some data to low-privilege usersVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.1Oracle JD Edwards EnterpriseOne Tools: monitoring component allows data read and writeVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle JD Edwards EnterpriseOne Tools: unauthenticated HTTP takeover after one user clickJD Edwards EnterpriseOne ToolsPackage2026-10-20 22:20 UTCby InfraStack Analyst–FIX 9.2.26.6 HIGH8.8Oracle JD Edwards EnterpriseOne Tools: low-privilege network user can take overJD Edwards EnterpriseOne ToolsVendor2026-10-20 22:20 UTCby InfraStack Analyst–FIX 9.2.26.6 (unconfirmed, per Armis)MEDIUM4.3Oracle JD Edwards EnterpriseOne Tools: low-privilege network user can partly crash serviceOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.4Oracle JD Edwards EnterpriseOne Tools: low-privilege read access and partial denial of serviceVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.4Oracle JD Edwards EnterpriseOne LATAM localizations: read access and partial denial of serviceVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.6Oracle JD Edwards EnterpriseOne Tools: local low-privilege user can alter some dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.5Oracle JD Edwards EnterpriseOne Tools: low-privilege user reads protected dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle JD Edwards EnterpriseOne Tools: Monitoring flaw exposes data to adjacent attackersVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.4Oracle JD Edwards EnterpriseOne Tools: unauthenticated network access to dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.1Oracle JD Edwards EnterpriseOne Tools: adjacent-network flaw allows data read and modificationVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.2Oracle JD Edwards EnterpriseOne Tools: monitoring component flaw exposes dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle JD Edwards EnterpriseOne Orchestrator: low-privilege users can read critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle JD Edwards EnterpriseOne Tools: low-privilege user can crash server via JDENETOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.3Oracle JD Edwards EnterpriseOne Tools: Web Runtime flaw leaks some stored dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.9Oracle JD Edwards EnterpriseOne Tools: Portal SEC flaw exposes data over HTTPVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.1Oracle JD Edwards EnterpriseOne Tools: unauthenticated flaw lets attackers read and change dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.1Oracle JD Edwards EnterpriseOne Tools: web runtime flaw allows data read and changeVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.1Oracle JD Edwards EnterpriseOne Tools: web runtime flaw allows data read and changeVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.5Oracle JD Edwards EnterpriseOne Tools: low-privileged user reads protected dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle JD Edwards EnterpriseOne Orchestrator: unauthenticated read of some accessible dataOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle JD Edwards EnterpriseOne Orchestrator: unauthenticated flaw exposes critical data over HTTPVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.6Oracle JD Edwards EnterpriseOne Tools: Monitoring flaw exposes data to high-privilege usersVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle JD Edwards EnterpriseOne Tools: monitoring flaw exposes data over HTTPVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.6Oracle JD Edwards EnterpriseOne Tools: unauthenticated network flaw exposes critical dataOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.4Oracle JD Edwards EnterpriseOne Tools: unauthenticated network flaw exposes critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.1Oracle JD Edwards EnterpriseOne Tools: low-privilege network attacker gains data accessVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle JD Edwards EnterpriseOne Tools: low-privilege network user can take overJD Edwards EnterpriseOne ToolsVendor2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO HIGH8.1Oracle JD Edwards EnterpriseOne Tools: low-privilege users can read and change dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle JD Edwards EnterpriseOne Tools: web runtime flaw enables full takeoverJD Edwards EnterpriseOne ToolsPackage2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO HIGH8.6Oracle JD Edwards EnterpriseOne Tools: unauthenticated SOAP flaw exposes critical dataJD Edwards EnterpriseOne ToolsVendor2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO HIGH8.4Oracle JD Edwards EnterpriseOne Tools: low-privileged logon can compromise dataInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO CRITICAL9.1Oracle JD Edwards EnterpriseOne Tools: unauthenticated network flaw exposes critical dataJD Edwards EnterpriseOne ToolsVendor2026-10-20 22:20 UTCby InfraStack Analyst–FIX 9.2.26.6 LOW3.7Oracle PeopleSoft SCM Manufacturing: unauthenticated HTTP flaw allows limited data changesVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.9Oracle PeopleSoft PeopleTools: Notification Configuration flaw allows data read and changeVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.4Oracle WebCenter Content: unauthenticated HTTP flaw leaks and alters some stored dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.1Oracle WebCenter Content: low-privilege user can read some stored dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.2Oracle E-Business Suite iProcurement: high-privilege attacker can take over componentRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle Identity Manager: low-privilege HTTP attacker can take over serverOracle Identity ManagerOther2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU patch (number unknown)MEDIUM6.5Oracle E-Business Suite iSupport: low-privilege network attacker reads critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.1Oracle Solaris 11.4: HTTP service flaw allows crash and partial data readOracle SolarisInfrastructure2026-10-20 22:20 UTCby InfraStack Analyst–FIX 11.4 SRU96 (11.4.96.227.1)HIGH7.5Oracle Solaris 11.4 kernel flaw lets unauthenticated remote hang or crashInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle Solaris 11.4 kernel flaw lets unauthenticated network attacker crash the hostInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.8Oracle Solaris 11.4 kernel flaw lets local users take over the systemInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.2Oracle Solaris Services: unauthenticated HTTP request crashes or reads dataInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO CRITICAL9.9Oracle SOA Suite Adapters flaw lets low-privilege users take over serverOracle SOA SuiteRuntime2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.9Oracle SOA Suite Adapters: low-privilege network takeover of serverOracle SOA SuiteVendor2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO LOW3.3Oracle Solaris 11.4 Libraries flaw lets local users read some dataInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle WebCenter Portal: unauthenticated HTTP request reads a subset of dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.9Oracle WebCenter Portal: Runtime Tools flaw allows unauthenticated data changes over HTTPVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.1Oracle WebCenter Portal: Runtime Tools flaw lets attackers read and change dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle WebCenter Portal: Runtime Tools flaw exposes data to unauthenticated network attackersVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.7Oracle Solaris 11.4: local low-privilege user can crash the systemInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO CRITICAL9.6Oracle BPM Suite: low-privileged HTTP user can read and change dataOracle Business Process Management SuiteVendor2026-10-20 22:20 UTCby InfraStack Analyst–FIX Oct 2026 CPU patch (number unknown)HIGH7.4Oracle Solaris 11.4 Plugins flaw lets privileged local user compromise systemInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO CRITICAL9.1Oracle Business Intelligence: high-privilege attacker can take over the serverOracle Business Intelligence Enterprise EditionRuntime2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.9Oracle WebCenter Sites: unauthenticated HTTP flaw exposes critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle SOA Suite: low-privilege network attacker can take over serverOracle SOA SuiteRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU (patch ID unknown)HIGH7.1Oracle SOA Suite Fabric Layer flaw lets low-privileged users change data over HTTPVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle SOA Suite: unauthenticated HTTP flaw exposes critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO CRITICAL9.8Oracle SOA Suite: unauthenticated network flaw allows full takeoverOracle SOA SuiteRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX unknown (Oct 2026 CPU patch)CRITICAL9.8Oracle SOA Suite Fabric Layer: unauthenticated network attacker can take over serverOracle SOA SuiteRuntime2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8Oracle SOA Suite: unauthenticated network flaw allows full server takeoverOracle SOA SuiteRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU patch (number unknown)CRITICAL9.8Oracle SOA Suite: unauthenticated SOAP flaw allows full takeoverOracle SOA SuiteRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU patch (number unknown)CRITICAL9.9Oracle SOA Suite: low-privilege network flaw lets attackers take over serverOracle SOA SuitePackage2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU patch (number unknown)CRITICAL10.0Oracle SOA Suite Adapters: unauthenticated network takeover of the serverInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO CRITICAL9.3Oracle SOA Suite: unauthenticated network flaw lets attackers access critical dataOracle SOA SuiteRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU patch (number unknown)HIGH7.5Oracle SOA Suite: Fabric Layer flaw lets low-privilege users take overRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.1Oracle SOA Suite: Fabric Layer flaw exposes data to low-privileged network usersVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle SOA Suite: Fabric Layer flaw lets low-privileged users take overRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle SOA Suite Fabric Layer flaw lets low-privileged users take overRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO CRITICAL9.1Oracle SOA Suite Adapters: unauthenticated HTTP flaw allows data changes and crashesOracle SOA SuiteRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU patch (number unknown)CRITICAL9.9Oracle SOA Suite: low-privilege HTTP attacker can take over serverOracle SOA SuitePackage2026-10-20 22:20 UTCby InfraStack Analyst–FIX Oct 2026 CPU patch (number unknown)HIGH8.8Oracle SOA Suite: low-privilege HTTP attacker can take over serverOracle SOA SuiteRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU patch (number unknown)CRITICAL9.9Oracle BPM Suite: low-privilege SOAP request takes over the serverOracle Business Process Management SuiteRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU patch (exact version unknown)CRITICAL10.0Oracle SOA Suite: unauthenticated network flaw allows full server takeoverOracle SOA SuitePackage2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8Oracle BPM Human Workflow: unauthenticated network attacker can take over serverOracle Business Process Management SuiteRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX Oracle CPU October 2026 patch (number unknown)HIGH8.6Oracle SOA Suite: unauthenticated HTTP flaw exposes critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO CRITICAL9.6Oracle SOA Suite: low-privilege HTTP request can alter or read all dataOracle SOA SuiteRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU patch (no version number)HIGH8.6Oracle SOA Suite Fabric Layer flaw lets unauthenticated attackers read dataOracle SOA SuiteVendor2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU patch (number unknown)CRITICAL10.0Oracle SOA Suite: unauthenticated network flaw lets attackers take over serverVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle SOA Suite: low-privilege HTTP request lets attackers take over serverOracle SOA SuiteRuntime2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8Oracle SOA Suite Fabric Layer flaw lets unauthenticated network attackers take overOracle SOA SuiteRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU patch HIGH8.8Oracle BPM Suite: BPM Composer flaw lets low-privilege users take over serverOracle Business Process Management SuiteRuntime2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO HIGH8.6Oracle Identity Manager Connector: unauthenticated REST flaw exposes critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.7Oracle Identity Manager Connector: privileged SOAP attacker can modify critical dataOracle Identity Manager ConnectorVendor2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5Oracle WebCenter Content Server: flaw lets low-privilege users reach stored dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.2Oracle Solaris X Window System flaw lets local users alter dataInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.1Oracle Solaris 11.4 Services flaw lets local users crash the hostInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.8IBM Cyber Fraud: authenticated users can upload dangerous file types and run codeOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.5Oracle Solaris 11.4: X Window System flaw lets local users alter dataInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW2.5Oracle Solaris 11.4 Services flaw allows limited data changes locallyInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.1Oracle Solaris: Image Packaging System flaw lets unauthenticated network attackers compromise hostsInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle Service Bus: low-privilege network user can take over serverOracle Service BusRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX unknown: October 2026 CPU patch HIGH8.8Oracle Service Bus: low-privileged HTTP user can take over the serverOracle Service BusRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU patch (version string not public)LOW2.5Oracle PeopleSoft PeopleTools: low-privilege local user reads some dataOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle Solaris: Image Packaging System flaw exposes data over HTTPInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.7Oracle PeopleSoft PeopleTools: Report Distribution flaw leaks some stored dataPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle PeopleSoft PeopleTools: Report Distribution flaw exposes data to unauthenticated attackersVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.1Oracle Solaris: Image Packaging System flaw allows limited data changesInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.5Oracle Solaris 11.4: local user can crash the filesystem stackInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW2.7Oracle PeopleSoft PeopleTools: Report Distribution flaw leaks some stored dataPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.5Oracle Solaris 11.4: local user can crash the Filesystems componentInfrastructure2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.8Oracle PeopleSoft PeopleTools: Report Distribution flaw exposes data to unauthenticated attackersOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle PeopleSoft PeopleTools: nVision flaw exposes data to low-privileged usersVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.7Oracle E-Business Suite: Personalization flaw lets low-privilege users change critical dataPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle E-Business Suite: Applications Framework flaw exposes data to unauthenticated attackersPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle E-Business Suite Pasta printing engine flaw allows takeover over HTTPVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.1Oracle E-Business Suite: Applications DBA flaw exposes critical data to local usersVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.3Oracle E-Business Suite: AD Utilities flaw lets local users take over Applications DBAVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.3Oracle PeopleSoft PeopleTools: XML Publisher flaw leaks a subset of dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.9Oracle WebCenter Content: unauthenticated HTTP flaw exposes stored content dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.3Oracle WebCenter Content: low-privileged user can alter data over HTTPVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle Outside In: unauthenticated network request crashes or hangs the libraryPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle Outside In: unauthenticated network flaw lets attacker take over the libraryOracle Outside In TechnologyPackage2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5Oracle Outside In: unauthenticated HTTP flaw exposes critical data to attackersPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle Outside In: unauthenticated HTTP request crashes the library, denial of servicePackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.2Oracle Outside In: unauthenticated network flaw exposes critical data and causes partial DoSPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Outside In: crafted file input can crash the document parserPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle WebCenter Content: Imaging flaw lets low-privilege users modify data via SOAPRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.5Oracle WebCenter Content Imaging: local high-privilege flaw exposes stored dataPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.4Oracle WebCenter Content: unauthenticated HTTP flaw allows partial data change and denial of servicePackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.7Oracle JD Edwards EnterpriseOne HR: unauthenticated network flaw allows limited data changesVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle JD Edwards EnterpriseOne Configurator: low-privilege users can alter dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle JD Edwards EnterpriseOne Homebuilder: low-privileged users can alter critical dataPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle JD Edwards EnterpriseOne General Ledger: low-privilege user can crash servicePackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.8Oracle JD Edwards EnterpriseOne HR: unauthenticated network flaw allows data read and changeVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.4Oracle JD Edwards EnterpriseOne HR: low-privilege network user can modify dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.7Oracle JD Edwards EnterpriseOne Tools: Package Build flaw allows full takeoverOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle JD Edwards EnterpriseOne Operational Sourcing: low-privilege SMTP access exposes dataPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.4Oracle JD Edwards EnterpriseOne Tools: low-privilege users can read and change some dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle JD Edwards EnterpriseOne Sales Order Entry: low-privileged network access exposes dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.3Oracle WebCenter Content Imaging: SOAP flaw leaks a subset of stored dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle WebCenter Content Imaging: low-privileged HTTP user reads critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.8Oracle WebCenter Content Imaging: low-privileged SOAP user can read and change dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.8Oracle WebCenter Content Imaging: low-privileged user can alter and read dataOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle WebCenter Content Imaging: low-privilege HTTP flaw exposes stored dataPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.8Oracle WebCenter Content Server: low-privilege HTTP attacker reads and changes dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle WebCenter Content Server: unauthenticated flaw exposes and alters stored dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle WebCenter Content Server: low-privilege local user reads critical dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.8Oracle WebCenter Content: adjacent-network attacker can read and change stored dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle WebCenter Content: Content Server flaw exposes data over HTTPRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.5Oracle Service Bus: unauthenticated HTTP request can crash or hang serverVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO LOW3.7Java SE: JAXP flaw lets remote attacker alter some dataRuntime2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.9Oracle E-Business Suite: Web Utilities flaw exposes data to high-privileged usersPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle WebCenter Content: low-privileged HTTP request can crash Content ServerVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle Service Bus: low-privilege network attacker can take over serverOracle Service BusRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX unknown: October 2026 CPU patch HIGH7.5Oracle E-Business Suite Payroll: low-privileged network attacker can take overVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM6.5Oracle Agile PLM: Folders, Files and Attachments flaw exposes stored dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.3Oracle WebCenter Content: low-privilege HTTP user can alter some stored dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM5.3Oracle WebCenter Content: unauthenticated flaw exposes stored content over HTTPPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH8.8Oracle Service Bus: low-privilege HTTP attacker can take over serverOracle Service BusRuntime2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO HIGH7.1Oracle E-Business Suite General Ledger: low-privilege users can alter or crash dataVendor2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.2Oracle E-Business Suite: Order Capture flaw lets privileged users take over the productOther2026-10-20 22:20 UTCby EPSS–WHAT TO DO HIGH7.8Oracle E-Business Suite: Valid Session flaw lets low-privileged users take overPackage2026-10-20 22:20 UTCby EPSS–WHAT TO DO MEDIUM4.4Oracle PeopleSoft PeopleTools: Panel Processor flaw allows limited data changesVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM4.3Oracle TimesTen Kubernetes Operator: low-privilege user reads some database dataPackage2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM4.5Oracle PeopleSoft PeopleTools: Porting flaw allows partial data change and denial of serviceVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM4.4Oracle PeopleSoft PeopleTools: LDAP component lets low-privileged users change dataPackage2026-10-20 22:20 UTCby NVD–WHAT TO DO HIGH8.8Oracle GoldenGate: low-privilege network attacker can take over Admin ServerPackage2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM4.5Oracle PeopleSoft PeopleTools: low-privilege local user can alter some dataVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle PeopleSoft PeopleTools: security flaw allows takeover by a privileged userVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM4.2Oracle PeopleSoft PeopleTools: high-privilege user can alter some dataPackage2026-10-20 22:20 UTCby NVD–WHAT TO DO CRITICAL9.6Oracle HTTP Server: OSSL module flaw lets low-privilege users take overOracle HTTP ServerRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX 12.2.1.4.0 + patch 40005842 HIGH8.7Oracle HTTP Server: WebLogic proxy plug-in flaw exposes server dataOracle HTTP Server (WebLogic Server Proxy Plug-in)Vendor2026-10-20 22:20 UTCby InfraStack Analyst–FIX Oct 2026 CPU patch (number unconfirmed)MEDIUM6.1Oracle PeopleSoft PeopleTools: Business Interlink flaw allows unauthorized data read and changePackage2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle PeopleSoft PeopleTools: LDAP flaw allows unauthenticated data read and changeVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM4.8Oracle PeopleSoft PeopleTools Portal flaw allows unauthenticated data read and changeVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle PeopleSoft PeopleTools: unauthenticated flaw exposes and alters critical dataVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO LOW3.7Oracle PeopleSoft PeopleTools Portal: unauthenticated flaw allows limited data changesVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO LOW3.1Oracle Siebel CRM Integration REST flaw leaks a subset of dataVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM6.9Oracle Siebel CRM Integration EAI: unauthenticated HTTP flaw exposes CRM dataVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO CRITICAL10.0Oracle Access Manager: unauthenticated HTTP flaw gives full data accessOracle Access ManagerPackage2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.3Oracle PeopleSoft PeopleTools Portal flaw exposes data to low-privileged usersVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite: Applications DBA flaw exposes critical data over HTTPRuntime2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM5.5Oracle JDeveloper: ADF Faces flaw exposes data to low-privileged local usersPackage2026-10-20 22:20 UTCby NVD–WHAT TO DO LOW3.6Oracle JD Edwards EnterpriseOne Tools: low-privilege local data read and write flawPackage2026-10-20 22:20 UTCby NVD–WHAT TO DO LOW3.0Oracle JD Edwards EnterpriseOne Tools: local privileged user can alter dataVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO LOW3.4Oracle JD Edwards EnterpriseOne Tools: local attacker can alter some dataVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM4.2Oracle JD Edwards EnterpriseOne Tools: high-privilege local user can alter dataVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle JD Edwards EnterpriseOne Tools: local low-privilege flaw enables data changes and crashesVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle JD Edwards EnterpriseOne Tools: flaw exposes data to unauthenticated network attackersOther2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle JD Edwards EnterpriseOne Tools: adjacent-network flaw exposes and alters dataVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle JD Edwards EnterpriseOne Tools: unauthenticated HTTP flaw exposes dataOther2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM6.4Oracle JD Edwards EnterpriseOne Tools: network flaw allows crash and data accessVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM6.4Oracle JD Edwards EnterpriseOne Tools: network flaw allows crash and data accessVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM5.5Oracle JD Edwards EnterpriseOne Tools: low-privilege local user reads protected dataVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO HIGH8.4Oracle VirtualBox 7.2.20: high-privilege adjacent attacker can take over hostInfrastructure2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM6.4Oracle JD Edwards EnterpriseOne Tools: Package Build flaw lets admins take overOther2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM6.7Oracle JD Edwards EnterpriseOne Tools: UNIX component flaw allows takeoverVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM6.3Oracle JD Edwards EnterpriseOne Tools: low-privilege local flaw exposes critical dataVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM6.3Oracle JD Edwards EnterpriseOne Tools: local low-privilege flaw exposes critical dataVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM4.8Oracle JD Edwards EnterpriseOne Tools: SMTP flaw allows data change and partial outageVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO HIGH7.8Oracle JD Edwards EnterpriseOne Tools: local low-privilege account can take overVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO HIGH7.5Oracle JD Edwards EnterpriseOne Tools: unauthenticated HTTP flaw allows data modificationVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO HIGH7.4Oracle JD Edwards EnterpriseOne Tools: unauthenticated network attacker can modify dataVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO HIGH8.8Oracle JD Edwards EnterpriseOne Tools: low-privilege network user can take overJD Edwards EnterpriseOne ToolsVendor2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5Oracle JD Edwards EnterpriseOne Tools: low-privilege network attacker can take overVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM5.6Oracle VirtualBox 7.2.16: local low-privilege user can crash hostOther2026-10-20 22:20 UTCby NVD–WHAT TO DO HIGH8.8Oracle JD Edwards EnterpriseOne Tools: low-privilege network attacker takes over serverJD Edwards EnterpriseOne ToolsVendor2026-10-20 22:20 UTCby InfraStack Analyst–FIX 9.2.26.6 HIGH8.1Oracle JD Edwards EnterpriseOne Tools: low-privilege HTTP flaw allows data changes and crashesVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO HIGH7.1Oracle JD Edwards EnterpriseOne Tools: low-privilege user gains broad data accessOther2026-10-20 22:20 UTCby NVD–WHAT TO DO HIGH7.1Oracle JD Edwards EnterpriseOne Tools: low-privilege network flaw exposes critical dataVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO HIGH8.1Oracle JD Edwards EnterpriseOne Tools: low-privilege network flaw lets attackers modify dataVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO HIGH8.1Oracle JD Edwards EnterpriseOne Tools: SMTP flaw allows takeover by unauthenticated attackersVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO HIGH8.6Oracle Outside In: unauthenticated network flaw exposes accessible data to attackersOther2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle VirtualBox 7.2.16: local low-privilege user can crash hostVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO CRITICAL9.1Oracle WebLogic Server: unauthenticated HTTP attacker can read and change dataRuntime2026-10-20 22:20 UTCby NVD–WHAT TO DO HIGH8.4Oracle VirtualBox: local low-privilege user can read data and crash hostInfrastructure2026-10-20 22:20 UTCby NVD–WHAT TO DO HIGH8.7Oracle WebLogic proxy plug-in flaw lets unauthenticated remote attackers compromise dataOracle WebLogic Server Proxy Plug-inRuntime2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.1Oracle WebCenter Content: unauthenticated HTTP flaw allows limited data read and changesVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle WebCenter Content: low-privilege HTTP flaw exposes critical stored dataVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM6.7Oracle Billing and Revenue Management: local high-privilege attacker can take over productVendor2026-10-20 22:20 UTCby NVD–WHAT TO DO HIGH7.5Oracle Access Manager: unauthenticated HTTP flaw exposes critical dataRuntime2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite HRMS India Indian Payroll: low-privilege user reads payroll dataOther2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle Java SE: network attacker can read and change some dataRuntime2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle Java SE: RMI flaw lets unauthenticated network attacker read and alter dataRuntime2026-10-20 22:20 UTCby NVD–WHAT TO DO LOW3.7Oracle Java SE: networking flaw lets unauthenticated attackers alter some dataRuntime2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle Java SE: Networking flaw lets unauthenticated attackers read some dataRuntime2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle Java SE: JAXP flaw lets unauthenticated network attackers read dataRuntime2026-10-20 22:20 UTCby NVD–WHAT TO DO HIGH8.8Oracle Business Intelligence: low-privilege HTTP user can take over serverOracle Business Intelligence Enterprise EditionVendor2026-10-20 22:20 UTCby InfraStack Analyst–WHAT TO DO LOW3.7Java SE Compiler: low-impact flaw leaks a subset of readable dataRuntime2026-10-20 22:20 UTCby NVD–WHAT TO DO CRITICAL9.8Oracle Access Manager: unauthenticated SAML flaw allows full takeoverOracle Access ManagerRuntime2026-10-20 22:20 UTCby InfraStack Analyst–FIX October 2026 CPU patch (number on MOS)MEDIUMNOT SCOREDCrypt::Age for Perl: unbounded recipient stanzas exhaust CPU during decryptionPackage2026-10-20 22:20 UTCby NVD–WHAT TO DO MEDIUM6.6Oracle PeopleSoft PeopleTools: Multichannel Framework flaw allows full takeoverRuntime2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH8.7Oracle Access Manager: authentication engine flaw lets unauthenticated attacker alter dataRuntime2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH8.1Oracle Access Manager: SAML authentication flaw lets unauthenticated attackers take overVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH8.6Oracle Access Manager: unauthenticated network attacker can read and change some dataRuntime2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM6.7Oracle Billing and Revenue Management: local admin takeover of Platform componentVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH7.5MySQL Connector/Python: unauthenticated network attacker gains access to dataPackage2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH8.8Oracle Identity Manager: low-privilege HTTP attacker can take over the serverOracle Identity ManagerRuntime2026-10-20 22:19 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8Oracle Identity Manager: low-privilege network attacker can take over serverOracle Identity ManagerRuntime2026-10-20 22:19 UTCby InfraStack Analyst–FIX October 2026 CPU patch (number on MOS)MEDIUM6.1Oracle Identity Manager: OIM Legacy UI flaw allows unauthenticated data changes over HTTPVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle Java SE JAXP: unauthenticated network attacker causes partial denial of serviceRuntime2026-10-20 22:19 UTCby NVD–WHAT TO DO CRITICAL9.8Oracle WebLogic Server: unauthenticated network flaw allows full server takeoverOracle WebLogic ServerRuntime2026-10-20 22:19 UTCby InfraStack Analyst–FIX October 2026 CPU PSU 40069416 (12.2.1.4.0)HIGH8.2Oracle Data Integrator: unauthenticated HTTP flaw exposes data and allows changesVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO CRITICAL9.8Oracle Data Integrator: unauthenticated HTTP flaw lets attackers take overOracle Data IntegratorRuntime2026-10-20 22:19 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8Oracle Data Integrator: unauthenticated RMI access lets attackers take overOracle Data IntegratorInfrastructure2026-10-20 22:19 UTCby InfraStack Analyst–FIX October 2026 CPU patch (number unknown)MEDIUM6.5Oracle Java SE: Networking flaw lets unauthenticated attackers alter data and disrupt serviceRuntime2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM6.8Oracle Demand Planning: low-privilege HTTP attack exposes critical dataVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH8.5Oracle E-Business Suite: Product Hub flaw lets low-privilege users take overRuntime2026-10-20 22:19 UTCby NVD–WHAT TO DO LOW3.1Oracle E-Business Suite: Applications Manager Diagnostics leaks some data to low-privilege usersVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle E-Business Suite HRMS: US Payroll Year End flaw allows data read and changePackage2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM4.2Oracle E-Business Suite: Applications Manager Diagnostics flaw leaks data, partial DoSVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle E-Business Suite HRMS (UK): flaw lets low-privileged users change some HR dataVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO LOW2.2Oracle E-Business Suite: Applications Manager Diagnostics leaks some data to adminsVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle Java SE JDBC flaw lets unauthenticated network attacker read dataRuntime2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite HRMS: low-privilege users can read HR dataVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite HRMS: low-privileged users can read HR dataPackage2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite HRMS: low-privilege user can read HR dataVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite HRMS: low-privileged user can read HR dataVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM4.3Oracle E-Business Suite: Report Manager flaw lets low-privilege users read some dataVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM4.8Oracle Java SE: Security component flaw allows limited data read and writeRuntime2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle Java SE: JAAS component flaw leaks a subset of dataRuntime2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH8.7Oracle WebLogic proxy plug-in flaw lets unauthenticated HTTP attackers read and change dataOracle WebLogic Server Proxy Plug-inVendor2026-10-20 22:19 UTCby InfraStack Analyst–WHAT TO DO MEDIUM4.8Oracle Java SE: compiler flaw lets remote attackers change some dataRuntime2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle E-Business Suite HRMS: Mobile Applications flaw leaks and alters HR dataOther2026-10-20 22:19 UTCby NVD–WHAT TO DO LOW3.7Oracle Java SE: JSSE flaw lets network attacker alter some dataRuntime2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM6.0Oracle PeopleSoft HCM: Administer Workforce flaw enables data changes over HTTPVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle Java SE: a hard-to-exploit flaw lets remote users alter dataRuntime2026-10-20 22:19 UTCby NVD–WHAT TO DO LOW3.0Oracle PeopleSoft PeopleTools: Portal flaw leaks a subset of dataVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle PeopleSoft PeopleTools: Portal flaw lets low-privileged users change some dataVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle E-Business Suite HRMS (UK): flaw lets low-privilege users change HR dataVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite Sourcing Auctions flaw lets low-privileged users take overVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH7.4Oracle E-Business Suite: Shipping Execution Workflow Events flaw exposes dataVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH7.4Oracle E-Business Suite: Shipping Execution Workflow Events flaw exposes critical dataPackage2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH8.8Oracle CLM Public Sector: low-privilege HTTP user can take overOther2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH8.1Oracle E-Business Suite: low-privileged HTTP user can alter contract dataVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite: Korean Payroll flaw exposes HRMS data to low-privileged usersVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite HRMS India: Indian Payroll flaw exposes employee dataVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite HRMS Norway: low-privilege user reads HR dataVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite: Order Management flaw exposes critical data to low-privileged usersVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH8.1IBM Guardium Data Protection: hard-coded crypto key leaks sensitive information remotelyVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO CRITICAL10.0IBM DataStage on Cloud Pak for Data: unauthenticated write to shared RedisDataStage on Cloud Pak for DataInfrastructure2026-10-20 22:19 UTCby InfraStack Analyst–FIX 5.4 patch 8 HIGH8.8IBM Planning Analytics: stack buffer overflow lets attacker run codeIBM Planning Analytics LocalOther2026-10-20 22:19 UTCby InfraStack Analyst–FIX 2.1.24 LOW2.7Oracle Database Server: high-privilege Query Optimizer flaw leaks some stored dataPackage2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM4.7Oracle PeopleSoft PeopleTools: Integration Broker flaw allows limited data changesVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle PeopleSoft FIN Common Objects Argentina: eProcurement flaw lets low-privileged users change dataVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM6.0Oracle PeopleSoft PeopleTools: Updates Environment flaw lets admins alter dataOther2026-10-20 22:19 UTCby NVD–WHAT TO DO LOW1.9Oracle PeopleSoft PeopleTools: Open Query flaw leaks some stored dataPackage2026-10-20 22:19 UTCby NVD–WHAT TO DO LOW3.8Oracle PeopleSoft PeopleTools: Data Mover flaw allows limited data changesPackage2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM6.8Oracle PeopleSoft PeopleTools: Push Notifications flaw allows takeover by privileged attackerVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle PeopleSoft PeopleTools: Search Framework flaw exposes data to adjacent attackersVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle PeopleSoft PeopleTools: Meta Data flaw exposes data and enables crashesVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM4.4Oracle PeopleSoft PeopleTools: Process Scheduler flaw allows limited data read and writeVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM4.2Oracle PeopleSoft PeopleTools: Search Framework flaw allows limited data read and changeVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM4.2Oracle PeopleSoft PeopleTools Portal: low-privilege users read data, partial denial of serviceVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM6.8Oracle PeopleSoft PeopleTools: Application Data Sets flaw allows data changes and crashesVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM5.5Oracle PeopleSoft PeopleTools: Query component flaw allows DoS and data changesVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO LOW3.7Oracle PeopleSoft PeopleTools: JRE component flaw allows limited data changesVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO LOW3.9Oracle PeopleSoft PeopleTools: Business Interlink flaw allows partial data changesPackage2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM4.2Oracle PeopleSoft PeopleTools: WebLogic component flaw allows limited data changesVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle E-Business Suite: Order Management flaw exposes order data over HTTPVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM4.4Oracle PeopleSoft PeopleTools: high-privilege local user reads critical dataVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle PeopleSoft PeopleTools: unauthenticated flaw exposes and changes application dataVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH7.8Oracle Solaris 11.4: local low-privilege user can take over the systemInfrastructure2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM5.8Oracle PeopleSoft PeopleTools Web Server: unauthenticated read of some dataVendor2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle Solaris 11.4: X Window System flaw lets local users alter dataInfrastructure2026-10-20 22:19 UTCby NVD–WHAT TO DO CRITICAL9.8Oracle Solaris: Image Packaging System flaw lets unauthenticated network attackers take overOracle SolarisInfrastructure2026-10-20 22:19 UTCby InfraStack Analyst–FIX 11.4 SRU96 (96.227.1), unconfirmed for this CVE HIGH8.8Oracle Solaris Utility flaw lets a low-privilege network user take overOracle SolarisInfrastructure2026-10-20 22:19 UTCby InfraStack Analyst–WHAT TO DO MEDIUMNOT SCOREDMozilla::CA Perl bundle trusts a root with publicly leaked intermediate keysPackage2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH7.8virtualenv activation scripts run code from a path that contains a placeholder namevirtualenvPackage2026-10-01 06:33 UTCby GitHub Advisories–FIX 21.14.2 HIGH7.8virtualenv activate.fish runs commands from a path or prompt with a backslash before a quotevirtualenvPackage2026-10-01 06:33 UTCby GitHub Advisories–FIX 21.14.2 LOW3.3djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tooldjustPackage2026-10-15 04:13 UTCby GitHub Advisories–FIX 1.0.10 MEDIUM5.6OGNL stricter-invocation block list bypass via java.lang.reflect reflection proxiesognl:ognlPackage2026-09-11 03:33 UTCby GitHub Advisories–FIX 3.4.13 HIGH7.5Moov signedxml: Unauthenticated denial of service in exclusive XML canonicalizationgithub.com/moov-io/signedxmlPackage2026-08-26 14:10 UTCby GitHub Advisories–FIX 1.4.1 HIGH7.5Bulwark Webmail: DNS rebinding lets unauthenticated requests reach internal servicesPackage2026-09-19 12:39 UTCby NVD–WHAT TO DO HIGH7.4OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runsgithub.com/openchoreo/openchoreoOther2026-09-09 05:30 UTCby GitHub Advisories–FIX 1.0.6 HIGH7.8virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBSTvirtualenvPackage2026-10-02 13:56 UTCby GitHub Advisories–FIX 21.14.4 HIGH7.5a2a-rs: push notification config enables server-side request forgery remotelyPackage2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH8.8Google Chrome: memory bug in Performance lets web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8087.47 HIGH8.8Chrome: sandbox memory corruption lets a crafted web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: memory corruption in network code lets web pages run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Chrome for Android: Skia memory corruption lets a crafted page read sandbox memorygoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Chrome on Windows: ANGLE memory corruption lets a web page read sandbox memorygoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: SVG use-after-free lets a crafted page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Turbolev lets a web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in Scroll lets a web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: memory corruption in compositing lets a web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in Extensions lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Windows: crafted web page can run code inside sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: memory corruption in Extensions lets crafted pages read sandbox memorygoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: GPU memory corruption lets a crafted web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: crafted HTML page can corrupt memory and run code in sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome for Android: memory corruption in CustomTabs lets crafted pages run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Chrome on Mac: installer out-of-bounds read leaks sandbox memorygoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: crafted HTML page can run code outside the sandboxgoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: Chromecast use-after-free lets a crafted page run code in sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome on Windows: memory corruption lets a crafted page read sandbox memorygoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome on iOS: memory corruption in SignIn lets crafted page read sandbox memorygoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: GPU use-after-free lets a crafted web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome for iOS: use-after-free lets a crafted web page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: memory corruption in Dawn lets a web page read sandbox memorygoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Extensions lets a web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome for iOS: crafted HTML page can corrupt memory and run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: accessibility use-after-free lets a web page run code in sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: ServiceWorker memory corruption lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Mac: accessibility memory bug lets crafted page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: input validation flaw lets a crafted page run code in sandboxgoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: ANGLE memory corruption lets a crafted page run code in sandboxgoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: media use-after-free lets a crafted web page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: crafted HTML page can corrupt memory in DevToolsgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Mac: Autofill memory corruption lets a crafted page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: ServiceWorker use-after-free lets a web page run code in the sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: Bluetooth out-of-bounds read leaks sandbox memory via crafted pagegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: out-of-bounds read in Media lets a crafted page read sandbox memorygoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free lets a crafted web page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: extension memory corruption lets a web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: crafted web page can run code inside the browser sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: use-after-free lets a crafted web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Chrome on Android: GPU memory corruption lets a crafted page read sandbox memorygoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: WebRTC memory corruption lets a crafted page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Extensions lets crafted web page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in web app installs lets a web page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: out-of-bounds write in Forms lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: WebProtect memory corruption lets a crafted page run code in sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Transactions Platform lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Chrome: Ozone access control flaw leaks sensitive data from crafted pagesgoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: memory corruption in Actor lets crafted page read sandbox memorygoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: out-of-bounds read in ANGLE leaks sandboxed memory on Windowsgoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: crafted HTML page can run code inside the browser sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Windows: ANGLE use-after-free lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome for Android: Omnibox input validation flaw lets a web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: FullScreen memory flaw lets a crafted page run code in sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM8.8Chrome: use-after-free in Input lets a web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby InfraStack Analyst–FIX 156.0.8078.47 HIGH8.8Chrome: crafted HTML page can run code inside the browser sandboxgoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in Core lets a web page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Prompts lets a web page run code in sandboxgoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: Google Lens memory corruption lets a web page run code in sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Windows: ANGLE memory corruption lets web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: XML memory corruption lets a crafted page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome for Windows: crafted web page can run code outside sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Mac: use-after-free lets a crafted web page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in site isolation lets a crafted page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in Paint lets a crafted page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in Accessibility lets crafted page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in extensions lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Chrome on Android: out-of-bounds read in CustomTabs leaks sandbox memorygoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: password manager memory bug lets crafted page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in API lets a crafted page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Reading Mode lets crafted page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: ANGLE memory corruption lets a crafted page run code in sandboxgoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in Extensions lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: accessibility use-after-free lets a crafted page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: use-after-free lets a crafted web page run code outside sandboxgoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in BrowserTag lets crafted page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on iOS: navigation memory corruption lets a crafted page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: video memory corruption lets a crafted page run code in sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: ANGLE memory corruption lets crafted page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: crafted web page can corrupt memory and run code in sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: crafted HTML page can run code inside the browser sandboxgoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome on Android: use-after-free lets a crafted web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Extensions lets a crafted page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: use-after-free in web app installs lets remote pages run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: memory corruption lets a crafted web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Frames lets a web page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: Chromoting memory corruption lets crafted page run code in sandboxgoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: media memory corruption lets a crafted web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Permissions lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome for Android: use-after-free in CustomTabs lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: DevTools memory corruption lets a crafted web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: Canvas use-after-free lets a crafted page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome on Windows: ANGLE input flaw lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: PDF use-after-free lets a crafted web page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: ANGLE use-after-free lets a crafted web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome for iOS: input validation flaw lets crafted page run code in sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: FileSystem memory corruption lets a crafted page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: DevTools memory corruption lets a crafted web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome on iOS: memory corruption lets crafted web page read sandboxed memorygoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: DevTools memory flaw lets a crafted web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: crafted HTML page can run code inside the browser sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: DOM memory corruption lets a crafted web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome on Windows: memory bug lets crafted page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: toolbar memory corruption lets crafted page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Chromecast lets crafted page run code in sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome for Android: crafted web page runs code inside sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: crafted HTML page can run code in sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: Chromoting memory bug lets crafted page read sandbox memorygoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on iOS: use-after-free in navigation lets a web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: crafted HTML page can run code outside the sandbox via Passwordsgoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: ANGLE memory corruption lets a crafted web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: out-of-bounds read lets a crafted page run code in sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in Search lets a crafted page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: crafted web page can run code inside the browser sandboxgoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: crafted HTML page can execute code inside the sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Loader lets a crafted page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in network stack lets crafted page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: editing use-after-free lets a web page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in Model lets a crafted page run code in sandboxgoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome on Android: memory corruption lets a crafted page read sandbox memorygoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Chrome on Android: WebAppInstalls memory corruption leaks sandboxed memoryOther2026-10-20 22:19 UTCby NVD–WHAT TO DO MEDIUM6.5Google Chrome: DevTools memory corruption lets crafted pages read sandbox memorygoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome V8: use-after-free lets a crafted web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: Google Lens use-after-free lets a web page run code in the sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: memory corruption in Extensions lets a web page run codeRuntime2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH8.8Chrome: memory corruption in Contacts lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: DataTransfer use-after-free lets a crafted page run code in sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: use-after-free lets web page run code in sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in navigation lets a web page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: extensions use-after-free lets a web page run code in sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: crafted HTML page can run code inside the sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: DevTools memory flaw lets a crafted page run code in sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGHNOT SCOREDChrome: PDF viewer memory corruption lets crafted HTML run codeRuntime2026-10-20 22:19 UTCby NVD–WHAT TO DO CRITICAL9.6Chrome: ServiceWorker memory corruption lets a crafted page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Windows: ANGLE use-after-free lets a web page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Chrome on iOS: navigation memory corruption lets a web page read sandbox memoryOther2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH8.8Google Chrome: crafted web page runs code inside the browser sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: use-after-free lets a crafted web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: Omnibox memory corruption lets a crafted web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Variations lets a crafted page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: crafted web page can run code in sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: CSS use-after-free lets a crafted web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in BrowserTag lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Chrome: memory corruption in Google Lens lets a crafted page read sandbox memorygoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: ANGLE use-after-free lets a crafted web page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: out-of-bounds read in Payments lets a web page read sandbox memorygoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: use-after-free in Extensions lets a web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Forms lets a web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUMNOT SCOREDChrome on iOS: access control flaw lets crafted pages bypass origin policyOther2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH8.8Google Chrome: crafted web page can run code inside the browser sandboxgoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption lets a crafted web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: V8 memory corruption lets a crafted page read sandbox memorygoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: V8 memory corruption lets a crafted web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Mac: use-after-free lets a web page run code in sandboxgoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: ServiceWorker use-after-free lets a crafted page run code in sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: use-after-free lets a crafted web page run code outside sandboxgoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: GPU memory corruption lets a web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in DOM lets crafted web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: DevTools memory corruption lets a web page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in Extensions lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: memory corruption in scheduling lets a web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: FedCM memory corruption lets a crafted web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: Passwords memory bug lets a crafted web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in navigation lets crafted page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: memory corruption lets a crafted page run codeOther2026-10-20 22:19 UTCby NVD–WHAT TO DO HIGH8.8Chrome: paint-code memory bug lets a crafted web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome on Mac: memory corruption in Views lets a web page read memorygoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in FileSystem lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: Omnibox memory corruption lets a crafted page run code in sandboxgoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: crafted HTML page runs code inside sandbox via FileSystemgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Extensions lets a web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: UI input validation flaw lets a crafted page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: ServiceWorker memory corruption lets crafted web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome for Android: memory flaw in Prompts lets remote code rungoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: Autofill use-after-free lets a web page run codeRuntime2026-10-20 22:19 UTCby NVD–WHAT TO DO CRITICAL9.6Chrome for Android: crafted HTML page runs code outside sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: permissions use-after-free lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in networking lets a crafted page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: History memory corruption lets crafted page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Mac: use-after-free lets a crafted web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome for Android: memory bug in Voice lets web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: WebGL use-after-free lets a web page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: crafted HTML page can run code inside the sandboxgoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: WebRTC use-after-free lets a crafted web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: use-after-free in Turbolev lets crafted page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: DevTools access flaw can leak data from a crafted pagegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: use-after-free in Streaming lets crafted pages run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: ANGLE flaw on Windows leaks data from crafted pagesgoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome for Android: use-after-free in Messages lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Glic lets a crafted page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: Canvas memory corruption lets a crafted page run code in sandboxgoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in Site Isolation lets a crafted page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in SignIn lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: out-of-bounds read lets a crafted page read sandbox memorygoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: memory corruption in Bindings lets crafted HTML run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: FullScreen memory corruption lets a crafted page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: WebUI memory corruption lets a crafted page run code in sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: WebShare input flaw lets a crafted page run code in sandboxgoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in PerformanceAPIs lets a web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome for Android: memory corruption lets crafted HTML run code in sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: speech memory bug lets crafted web page read sandbox memorygoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: ANGLE memory corruption lets a crafted web page read memorygoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: memory corruption in Extensions lets a web page read sandbox memorygoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free lets a crafted web page run code in sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: ANGLE use-after-free lets a crafted web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: Autofill memory corruption lets a crafted page read sandboxed memorygoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Google Chrome: memory flaw in web app installs lets a web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: extensions memory corruption lets a web page read sandbox memorygoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: DevTools memory corruption lets a crafted page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in Picture-in-Picture lets a web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Windows: ANGLE memory corruption lets a web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in PlatformIntegration lets a web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: DevTools memory flaw lets crafted web page run code in sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: Bluetooth memory corruption lets crafted web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Actor lets a crafted page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: extension access flaw leaks data via crafted HTML pagegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: Animation flaw lets a crafted page bypass web origin policygoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: memory corruption lets a crafted web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: crafted HTML page can run code outside sandbox via memory corruptiongoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: DevTools memory flaw lets a crafted web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in DataTransfer lets a web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: GPU use-after-free lets a crafted web page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: memory corruption in Loader lets a crafted page read sandbox memorygoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome for Android: crafted web page can corrupt memory and run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: crafted HTML page can run code inside the sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Windows: use-after-free lets a web page run code in sandboxgoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in Extensions lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Mac: crafted HTML page can run code inside sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: DevTools memory flaw lets a crafted web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Transactions Platform lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: use-after-free in sign-in lets a web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: use-after-free in Extensions lets crafted page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Extensions lets a crafted page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: compositing use-after-free lets a crafted page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: ShadowDOM memory corruption lets a crafted page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: memory corruption in API lets crafted web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Script lets a web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome for Android: media use-after-free lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: Skia memory corruption lets a crafted page run code in sandboxgoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Extensions lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in Frames lets a crafted page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in WebProtect lets a crafted page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: out-of-bounds read in FileSystem lets a web page read sandbox memorygoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: use-after-free lets a crafted web page run code in sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: audio memory corruption lets a crafted web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: Omnibox input flaw lets crafted page run code in sandboxgoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: CacheStorage memory corruption lets a web page read sandbox memorygoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: use-after-free in FileSystem lets crafted page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome for Android: memory corruption lets crafted web page run codegoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: out-of-bounds read in Focus lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in an API lets a web page run codegoogle chromeVendor2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in DisplayLocking lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome for Android: use-after-free in Passwords lets crafted page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome for Android: memory bug in PerformanceAPIs lets a web page run codegoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: crafted web page runs code inside browser sandbox via interstitialsgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: print preview flaw lets a web page escape the sandboxgoogle chromeOther2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: memory corruption lets a crafted web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Actor lets a web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: crafted HTML page can run code inside the browser sandboxgoogle chromePackage2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: media use-after-free lets a crafted web page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: improper permission input validation lets crafted page run codegoogle chromeRuntime2026-10-20 22:19 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: memory corruption lets a crafted web page run codeRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Chrome on Windows: ANGLE memory corruption lets a web page read sandbox memoryRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Google Chrome: compositing use-after-free lets a crafted page run codegoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in web app installs lets a web page run codeRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Chrome: SiteIsolation use-after-free lets a crafted web page run codeOther2026-10-20 22:18 UTCby NVD–WHAT TO DO CRITICAL9.6Chrome: crafted HTML page can run code outside the sandboxRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Google Chrome on Mac: memory corruption lets a crafted page read sandbox memoryOther2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Chrome on Android: toolbar use-after-free lets a web page run codePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Google Chrome: DevTools use-after-free lets a crafted page run codegoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome on Windows: media use-after-free lets a web page run codegoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free lets a crafted web page run code in the sandboxgoogle chromeVendor2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Google Chrome: CSS memory corruption lets a crafted page escape sandboxgoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome for Android: notifications use-after-free lets a crafted page run codegoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: out-of-bounds read in GetUserMedia leaks sandbox memorygoogle chromeVendor2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: compositing memory corruption lets a crafted page run codegoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Input lets a crafted page run codegoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: Chromoting use-after-free lets a crafted page run code in sandboxgoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: font memory flaw lets a crafted page read sandbox memorygoogle chromeVendor2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: media use-after-free lets a crafted page run code in sandboxgoogle chromeVendor2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: crafted web page can corrupt memory and run code in sandboxgoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: crafted HTML page can run code inside the sandboxgoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: crafted HTML page can run code inside the browser sandboxgoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: Chromoting memory corruption lets a web page run code in sandboxgoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: Bluetooth input validation lets a crafted page run code in sandboxgoogle chromeVendor2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in Sensor lets crafted page run code in sandboxgoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in WebUI lets crafted page run codegoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: ComputePressure flaw lets web pages bypass origin policygoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: memory corruption in PerformanceAPIs lets a web page run codegoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: type confusion in FullScreen lets a web page run codegoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: out-of-bounds read in SiteIsolation leaks sandbox memorygoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: cookie use-after-free lets a web page run codegoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome V8: memory corruption lets a crafted web page run codegoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: CSS memory corruption lets a crafted page read sandbox memorygoogle chromeVendor2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: crafted HTML page reads sandbox memory via HIDgoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption lets a crafted web page run code in sandboxgoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: DevTools memory corruption lets a crafted page run code in sandboxgoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: crafted HTML page can read sandboxed memory via BrowserTaggoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: crafted HTML page can run code inside the sandbox via Passwordsgoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Chrome for Android: out-of-bounds read lets a crafted page leak sandbox memorygoogle chromeVendor2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome V8: use-after-free lets a crafted web page run codegoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on iOS: use-after-free lets a crafted web page run codegoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: extension use-after-free lets a crafted web page run codegoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Actor lets a crafted web page run codegoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: crafted HTML page can run code inside the browser sandboxgoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: bookmarks use-after-free lets a crafted page run code in sandboxgoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: DevTools memory corruption lets a crafted page read sandbox memorygoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: WebSockets use-after-free lets a web page run code in sandboxgoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: HTML memory corruption lets a crafted page run code in sandboxgoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: out-of-bounds read lets a crafted page read sandbox memorygoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in FileSystem lets a web page run codegoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Streaming lets a web page run codegoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Android: Omnibox memory corruption lets a web page run codegoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Windows: media memory corruption lets crafted page run codegoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome V8: access control flaw lets a crafted page bypass origin policygoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: ANGLE access control flaw lets a web page run code in sandboxgoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in media lets a crafted page run codegoogle chromeVendor2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: WebFonts memory corruption lets a crafted page run code in sandboxgoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome on Android: PDF memory corruption lets a web page read sandboxed memorygoogle chromeVendor2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: crafted web page runs code inside browser sandbox via memory buggoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in web app installs lets a web page run codegoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: crafted web page breaks extensions and runs code outside sandboxgoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: PDFium memory corruption lets a crafted page run code in sandboxgoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in web app installs lets a crafted page run codegoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: crafted web page can run code outside the sandboxgoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Turbolev lets crafted web page run codegoogle chromeVendor2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: IME memory corruption lets crafted web page run sandboxed codegoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Views lets crafted web page run codegoogle chromeVendor2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: crafted web page can run code inside the browser sandboxgoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: use-after-free in Workers lets a web page run codegoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: PerformanceAPIs memory bug lets crafted web page run codegoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: DevTools memory corruption lets a crafted page run code in sandboxgoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: crafted HTML page can run code inside the GPU sandboxgoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome on Windows: crafted web page runs code inside sandboxgoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: out-of-bounds read in Extensions leaks sandboxed memorygoogle chromeVendor2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in WindowControlsOverlay lets a web page run codegoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: memory corruption lets a crafted web page run code in sandboxgoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Chrome: memory corruption in Permissions lets a web page run codegoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: out-of-bounds read in navigation lets a web page run codegoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: Bluetooth memory corruption lets a web page run code in the sandboxgoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in Sync lets a crafted page run codegoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in HID lets a crafted page run codegoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 MEDIUM6.5Google Chrome: memory corruption lets a crafted web page read sandbox memorygoogle chromeVendor2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Workers lets a web page run codegoogle chromeVendor2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in Paint lets crafted web page run codegoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in API lets a web page run codegoogle chromeVendor2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: memory corruption in Views lets a web page run codegoogle chromeVendor2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: CSS memory corruption lets crafted web page run code in sandboxgoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: crafted HTML page runs code inside sandboxgoogle chromeOther2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Animation lets a web page run codegoogle chromeVendor2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Google Chrome: memory corruption lets a crafted web page run codegoogle chromePackage2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 HIGH8.8Chrome: use-after-free in Input lets a crafted page run codegoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 CRITICAL9.6Google Chrome: Canvas memory corruption lets a crafted page run codegoogle chromeRuntime2026-10-20 22:18 UTCby NVD–FIX 156.0.8078.47 LOWNOT SCOREDPerl DBI: failed DBD::DBM open leaves a lock, hanging later table opensPackage2026-10-20 10:56 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDPerl DBI: type confusion in dbi_profile crashes processes on handle destructionPackage2026-10-20 21:13 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite: Order Management flaw exposes data to low-privileged network usersVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite: Order Management flaw exposes data to low-privilege network usersVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite: Product Hub flaw exposes data to low-privilege usersVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Oracle E-Business Suite Product Hub: low-privilege users can take over the appOracle Product Hub (E-Business Suite)Package2026-10-20 22:18 UTCby InfraStack Analyst–FIX October 2026 CPU patch (number in MOS note)HIGH8.8Oracle E-Business Suite Product Hub: low-privilege takeover over HTTPOracle Product Hub (E-Business Suite)Other2026-10-20 22:18 UTCby InfraStack Analyst–FIX October 2026 CPU HIGH8.8Oracle E-Business Suite Product Hub: low-privilege web user can take overOracle E-Business Suite Product HubPackage2026-10-20 22:18 UTCby InfraStack Analyst–FIX October 2026 CPU HIGH7.1Oracle E-Business Suite: Installed Base flaw lets low-privileged users read and change dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.1Oracle E-Business Suite: Installed Base HTML UI flaw exposes some data to attackersVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.6Oracle E-Business Suite: Installed Base flaw exposes critical data over HTTPVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite: Bills of Material flaw lets low-privileged users take overVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO LOW3.5Oracle E-Business Suite Purchasing: low-privilege users can alter some purchasing dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO LOW3.1Oracle E-Business Suite Purchasing: low-privilege user can alter some dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO LOW3.1Oracle E-Business Suite: Concurrent Requests flaw leaks some stored dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.5Oracle E-Business Suite: Production Scheduling flaw lets local users alter dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Oracle E-Business Suite SNO installer: unauthenticated takeover over HTTPOracle E-Business Suite Strategic Network OptimizationInfrastructure2026-10-20 22:18 UTCby InfraStack Analyst–FIX Oct 2026 CPU patch 40022426:12.2.0 (per Rapid7, unconfirmed)HIGH8.2Oracle E-Business Suite: Global Order Promising web service flaw exposes order dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.2Oracle E-Business Suite: Contract Lifecycle for Public Sector takeover by privileged usersPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.7Oracle E-Business Suite Shipping Execution: Workflow Events flaw enables crash and data accessPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite: iSupplier Portal flaw exposes data to low-privileged usersPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite Shipping Execution: unauthenticated HTTP flaw exposes dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.1Oracle E-Business Suite Shipping Execution: unauthenticated HTTP flaw allows takeoverVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.6Oracle E-Business Suite Shipping Execution: low-privilege network flaw exposes dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite: Order Management flaw exposes data to low-privilege usersPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.1Oracle E-Business Suite Quality: low-privilege network attacker reads and changes dataOther2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.7Oracle E-Business Suite: Project Contracts flaw exposes data to low-privileged network usersOther2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.4Oracle E-Business Suite: MWA Terminal Server flaw exposes data over HTTPVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite: Mobile Application Server flaw exposes data to low-privileged usersVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.1Oracle E-Business Suite HCM Common Architecture: low-privilege attackers can access critical dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite HCM Common Architecture: low-privilege network attacker can take overPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite HCM Common Architecture: remote takeover by low-privileged usersVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.7Oracle E-Business Suite: Attachments flaw lets low-privilege user alter dataOracle E-Business Suite (Document Management and Collaboration, Attachments)Other2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5Oracle E-Business Suite: Bills of Material flaw allows takeover over HTTPVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.2Oracle E-Business Suite: Bills of Material flaw lets privileged users modify dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle E-Business Suite: Compensation Workbench flaw allows limited data read and changeVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite General Ledger: low-privilege network attack allows full takeoverVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite General Ledger: low-privilege users can read critical dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.7Oracle E-Business Suite: Product Hub Item Catalog flaw exposes data over HTTPVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.2Oracle E-Business Suite: Product Hub flaw lets high-privileged users take overRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.6Oracle E-Business Suite Assets: low-privileged HTTP attacker can read, change and crashVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle E-Business Suite Change Management: unauthenticated read of some dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Oracle E-Business Suite Change Management: low-privilege network takeover of EngineeringOracle E-Business Suite (Engineering, Change Management)Package2026-10-20 22:18 UTCby InfraStack Analyst–FIX October 2026 CPU patch (number unknown)MEDIUM6.8Oracle E-Business Suite: CMRO LOV flaw lets low-privileged users change dataOther2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5MySQL Router: unauthenticated network attacker can hang or crash the routerPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO CRITICAL10.0Oracle E-Business Suite Workflow: unauthenticated network takeover via Notification MailerOracle E-Business Suite (Workflow Notification Mailer)Package2026-10-20 22:18 UTCby InfraStack Analyst–FIX October 2026 CPU (patch 40022426, per Rapid7)CRITICAL9.1Oracle E-Business Suite: unauthenticated WebUI flaw exposes and changes dataOracle E-Business Suite (Product Workbench WebUI)Vendor2026-10-20 22:18 UTCby InfraStack Analyst–FIX Oct 2026 CPU patch 40022426 (unconfirmed, per Rapid7)MEDIUM4.8Oracle Billing and Revenue Management: unauthenticated HTTP flaw exposes some billing dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.8MySQL Connector/ODBC 26.7.1: low-privileged attacker can read and change dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO LOW3.3Oracle E-Business Suite: Applications Manager Diagnostics flaw leaks data, partial denial of servicePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO LOW2.5MySQL Connector/ODBC: local partial denial of service, CVSS 2.5Package2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server: XML component flaw lets a privileged user crash or alter dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server parser flaw lets a low-privilege user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server: optimizer flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.8MySQL Server: privileges flaw lets low-privileged users change or read critical dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server: Group Replication flaw lets an adjacent attacker crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server optimizer flaw lets a privileged user crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5MySQL mysqldump client: flaw lets an attacker take over MySQL serversPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5MySQL Server replication flaw lets an unauthenticated network attacker take overPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.7MySQL Server: Components Services flaw lets a privileged local user take overPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server: XML component flaw lets low-privileged users crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.5Oracle BRM Elastic Charging Engine: low-privilege local user reads critical dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle BRM Elastic Charging Engine: adjacent-network flaw allows data changesVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.1Oracle Communications BRM Elastic Charging Engine: low-privilege network attackers gain data accessVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO LOW3.3Oracle Communications BRM Elastic Charging Engine: local low-privilege read access flawVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server optimizer flaw lets low-privileged users crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.9MySQL Server: unauthenticated network attacker can crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server optimizer flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.2MySQL Server optimizer flaw lets a privileged user take over the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.3MySQL Server: JSON component flaw lets low-privilege users corrupt data and crashPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server optimizer flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.4MySQL Router: unauthenticated network attacker can alter and read dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite: Applications Manager flaw exposes data to low-privilege usersRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8MySQL Group Replication: adjacent-network flaw lets attacker take over serverRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server X Plugin flaw lets low-privilege users crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO LOW2.7MySQL Server Telemetry flaw lets high-privileged users cause partial denial of servicePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server: low-privilege network user can crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.5MySQL Server: encryption component flaw allows crash and partial data readPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server: Group Replication flaw lets privileged user crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.4MySQL Server: replication flaw lets network attacker modify data and crashPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server: pluggable authentication flaw allows crash and some data changesPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.1MySQL Group Replication: adjacent-network attacker can crash server and alter dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.1MySQL Server and Cluster: client programs flaw allows server takeoverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.1MySQL Server and Cluster: client programs flaw allows full takeover over networkPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.1MySQL Server and Cluster: client programs flaw allows full server takeoverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.0MySQL Cluster: unauthenticated network flaw allows crash and data changesPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.1MySQL Connector/J: unauthenticated network attacker can take over the connectorPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO CRITICAL9.8PUBLIC EXPLOITOracle E-Business Suite: unauthenticated HTTP flaw lets attackers take over Application Object LibraryOracle E-Business Suite Application Object Library4 talkingPackage2026-10-20by InfraStack Analyst4talkingFIX Oct 2026 CPU (Patch 40022426:12.2.0, per Rapid7)MEDIUM4.4MySQL Server replication flaw lets a privileged user crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO CRITICAL9.1Oracle Billing and Revenue Management: unauthenticated HTTP flaw exposes all billing dataOracle Communications Billing and Revenue ManagementVendor2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.5Oracle Billing and Revenue Management: low-privilege local user reads critical dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO CRITICAL9.8Oracle BRM Elastic Charging Engine: unauthenticated RMI flaw allows full takeoverOracle Communications BRM - Elastic Charging EngineVendor2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.3MySQL Server and Cluster: encryption component flaw allows repeatable denial of servicePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.9MySQL Server: unauthenticated network attacker can crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server: InnoDB flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle Billing and Revenue Management: unauthenticated HTTP flaw exposes critical dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.2Oracle Billing and Revenue Management: unauthenticated HTTP flaw exposes billing dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.8Oracle E-Business Suite: low-privilege user can take over Application Object LibraryPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server GIS flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.3MySQL Server and Cluster: client programs flaw lets low-privilege users crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.4MySQL Server and Cluster: high-privilege client flaw can crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.4MySQL Server RAPID component flaw lets privileged users crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.4MySQL Server: high-privilege user can crash the server over networkPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server: Group Replication flaw lets a privileged user crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server Clone Plugin flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server and Cluster: high-privilege user can crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server: audit component flaw lets low-privilege users crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server InnoDB flaw lets a low-privileged user crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.3Oracle Agile Engineering Data Management: install flaw lets adjacent attacker compromise dataOracle Agile Engineering Data ManagementOther2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.3Oracle Agile Engineering Data Management: unauthenticated read access to some dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.4Oracle Agile Engineering Data Management: HTTP flaw lets low-privilege users change critical dataOther2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server GIS flaw lets low-privileged users crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Oracle E-Business Suite: Applications Manager Diagnostics flaw allows full takeoverOracle E-Business Suite (Applications Manager, Diagnostics)Other2026-10-20 22:18 UTCby InfraStack Analyst–FIX Oct 2026 CPU patch 40022426 (per Rapid7, unverified)MEDIUM5.3Oracle Agile Engineering Data Management: unauthenticated attacker reads critical data over segmentVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO LOW3.6Oracle Agile Engineering Data Management: local low-privilege flaw exposes some dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.0Oracle Agile Engineering Data Management: local low-privilege user can take overOracle Agile Engineering Data ManagementVendor2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO LOW3.1Oracle Agile Engineering Data Management: low-privilege users can alter some dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.9Java SE: Compiler flaw lets remote input crash or hang JavaRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.4Oracle Primavera Unifier: unauthenticated network flaw exposes and alters project dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.1Oracle Primavera Unifier: low-privileged users can alter and delete critical dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.3Oracle Agile Engineering Data Management: low-privilege HTTP flaw leaks some stored dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server JSON component flaw lets low-privilege users crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server optimizer flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server: Optimizer flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server optimizer flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server replication flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server: low-privileged network user can crash the server repeatedlyPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server replication flaw lets a privileged user crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server and Cluster: low-privilege network user can crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server and Cluster: low-privileged user can crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server: InnoDB flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.7Oracle Agile PLM MCAD Connector CAX Client: local takeover after user interactionOther2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.3MySQL Server: connection handling flaw leaks a subset of stored dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server: high-privilege user can crash the Components Services componentPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.3MySQL Server: connection handling flaw allows unauthorized data changes over networkRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle Agile PLM: application server flaw allows unauthenticated takeover over HTTPOracle Agile PLMOther2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5Oracle Agile PLM: unauthenticated flaw in Application Server exposes product dataOther2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.4Oracle Agile PLM: low-privileged local user can access and change dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle Agile PLM Web Client: unauthenticated read access to some dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle Agile PLM: unauthenticated flaw in Application Server exposes dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.1Oracle Agile PLM Web Client: unauthenticated flaw exposes and alters some dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle Agile PLM: low-privilege HTTP attacker can read and change some dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle Payroll: low-privilege network attacker can take over the productPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.6Oracle E-Business Suite Payroll: high-privileged attacker can take over over HTTPPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.8Oracle E-Business Suite Payroll: low-privilege network attack alters or reads payroll dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle E-Business Suite Payroll: low-privilege users can read and change some payroll dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite Payroll: low-privilege network attacker can take overVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.4Oracle E-Business Suite: Concurrent Processing flaw lets unauthenticated HTTP attackers alter dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite One-to-One Fulfillment: low-privilege HTTP flaw exposes dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.7Oracle E-Business Suite: Role Summary flaw lets privileged users change critical dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.2Oracle E-Business Suite: Concurrent Processing flaw lets a privileged user take overPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite Pasta: low-privileged network attacker can take overPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.0Oracle E-Business Suite: Concurrent Processing flaw exposes data to privileged local usersVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.1Oracle E-Business Suite: Application Object Library flaw allows unauthenticated takeover over HTTPOracle E-Business Suite (Application Object Library)Package2026-10-20 22:18 UTCby InfraStack Analyst–FIX October 2026 CPU patch HIGH7.5Oracle E-Business Suite: One-to-One Fulfillment Documents flaw allows takeoverVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite One-to-One Fulfillment: Java server flaw allows takeoverVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.1Oracle E-Business Suite: One-to-One Fulfillment admin console flaw exposes dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.8Oracle E-Business Suite: Application Object Library flaw exposes data over HTTPPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.8Oracle E-Business Suite One-to-One Fulfillment: Documents flaw allows data changes and crashesVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.2Oracle E-Business Suite Mobile Field Service: Admin UI flaw enables full takeoverVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Oracle E-Business Suite Mobile Field Service: Admin UI flaw allows takeoverVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.2Oracle E-Business Suite: unauthenticated network flaw exposes SOA Gateway dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.7Oracle E-Business Suite: SOA Gateway flaw leaks critical data over HTTPOracle E-Business Suite Integrated SOA GatewayVendor2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.6Oracle E-Business Suite SOA Gateway: unauthenticated HTTP flaw exposes critical dataOther2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite: SOA Gateway flaw lets low-privileged users take overVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Oracle E-Business Suite: SOA Gateway flaw lets low-privileged users take overOracle E-Business Suite Integrated SOA GatewayRuntime2026-10-20 22:18 UTCby InfraStack Analyst–FIX Oct 2026 CPU (Patch 40022426:12.2.0, unconfirmed for this CVE)HIGH8.8Oracle E-Business Suite SOA Gateway: low-privileged network user can take overOracle E-Business Suite Integrated SOA GatewayPackage2026-10-20 22:18 UTCby InfraStack Analyst–FIX October 2026 CPU (Patch 40022426)HIGH8.3Oracle E-Business Suite: SOA Gateway flaw lets low-privileged users change or read dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.0Oracle E-Business Suite: Applications DBA lets a local user take overPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.8Oracle E-Business Suite: AD Utilities flaw lets local attacker take over DBA toolingPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.0Oracle E-Business Suite: Applications DBA AD Utilities allows takeover by local usersVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.4Oracle Billing and Revenue Management: unauthenticated network flaw exposes critical billing dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5MySQL Server and Cluster: unauthenticated network crash causes denial of serviceRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.3MySQL Connector/J: unauthenticated network attacker can partially deny servicePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.3MySQL Connector/J 26.7.0: unauthenticated network attacker can alter some dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.8Oracle E-Business Suite: Concurrent Processing flaw lets local users take overPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.7Oracle E-Business Suite: Mobile Field Service flaw lets privileged users take overVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.7Oracle E-Business Suite: Mobile Field Service flaw lets privileged users take overRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite US Federal HR: low-privilege HTTP attacker reads critical dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.1Oracle E-Business Suite: Call Center component flaw allows unauthenticated takeover over RMIPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.1Oracle E-Business Suite Email Center: unauthenticated web request can alter some dataOther2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite Email Center: low-privilege HTTP attacker reads critical dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.8Oracle E-Business Suite: Public Sector HR flaw exposes and alters critical dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.1Oracle E-Business Suite Customer Care: unauthenticated HTTP flaw exposes and changes dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle E-Business Suite: Trade Management Claim LOV flaw exposes some dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle E-Business Suite: Trade Management Claim LOV flaw exposes data to low-privileged usersPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.1Oracle Mobile Field Service: low-privileged network user can read and modify dataOther2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Oracle Mobile Field Service: low-privilege HTTP attacker can take over serverOracle Mobile Field Service (E-Business Suite)Other2026-10-20 22:18 UTCby InfraStack Analyst–FIX Oct 2026 CPU patch 40022426 HIGH7.1Oracle Mobile Field Service Admin UI flaw lets low-privilege users change dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.4Oracle E-Business Suite Mobile Field Service: Admin UI flaw exposes critical dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite: Mobile Field Service Admin UI leaks data unauthenticatedVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.4Oracle E-Business Suite Mobile Field Service: Admin UI flaw exposes critical dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Oracle Mobile Field Service: low-privilege network attacker can take over the productOracle Mobile Field ServiceOther2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8Oracle E-Business Suite Mobile Field Service: low-privilege network attacker can take overOracle Mobile Field Service (E-Business Suite)Other2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8Oracle Mobile Field Service: low-privilege network attacker can take over productOracle Mobile Field Service (E-Business Suite)Package2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8Oracle E-Business Suite Mobile Field Service: low-privilege network takeoverOracle Mobile Field Service (E-Business Suite)Vendor2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5Oracle E-Business Suite: Partner Management flaw exposes critical data to low-privilege usersVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.1Oracle E-Business Suite: Partner Management flaw lets low-privilege users change dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.1Oracle E-Business Suite Partner Management: low-privilege users can alter dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.4Oracle E-Business Suite Partner Management: low-privilege network attack compromises dataOther2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite iSetup: low-privilege HTTP attack takes over the productOther2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.2Oracle E-Business Suite iSetup: high-privilege HTTP flaw allows full product takeoverVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle iSetup: flaw in General Ledger transform lets low-privilege users take overPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.6Oracle E-Business Suite Mobile Field Service: high-privilege HTTP flaw allows takeoverVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.1Oracle E-Business Suite: Sales Online flaw lets low-privileged users modify dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.1Oracle E-Business Suite Report Manager: low-privilege users can read critical dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.6Oracle E-Business Suite: Report Manager flaw exposes data to low-privileged usersVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.2Oracle E-Business Suite Marketing: unauthenticated HTTP flaw exposes and alters marketing dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle E-Business Suite Marketing Audience: flaw lets low-privilege users read and change dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.3Oracle E-Business Suite: AD Utilities flaw lets local users take over Applications DBARuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.5MySQL Server InnoDB flaw lets privileged users crash database or alter dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.4Oracle E-Business Suite Mobile Field Service: Admin UI flaw exposes critical dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Oracle E-Business Suite Mobile Field Service: network flaw allows full takeoverOracle Mobile Field Service (E-Business Suite)Vendor2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1Oracle Mobile Field Service: unauthenticated HTTP flaw exposes data and crashes serviceOracle E-Business Suite (Mobile Field Service)Other2026-10-20 22:18 UTCby InfraStack Analyst–FIX Oct 2026 CPU patch 40022426 (per Rapid7, unverified on Oracle MOS)MEDIUM4.3MySQL Router: low-privilege network attacker can read some router dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.3MySQL Router: unauthenticated flaw leaks a subset of router dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.8MySQL Router 26.7.0: unauthenticated network attacker can compromise data over HTTPSPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle E-Business Suite: Advanced Outbound Telephony flaw exposes and alters some dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server: InnoDB flaw lets a privileged user crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Cluster NDB Operator: low-privilege HTTP request can crash the clusterPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.4MySQL Server: InnoDB flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.9MySQL Connector/NET: unauthenticated network attacker can read connector dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.3MySQL Connector/Net: unauthenticated user can read a subset of dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server InnoDB flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server: Optimizer flaw lets a privileged user crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server: InnoDB flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server: InnoDB flaw lets a privileged user crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server optimizer flaw lets low-privileged users crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server: InnoDB flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server: InnoDB flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server InnoDB flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server JSON component flaw lets low-privilege users crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.4MySQL Server: InnoDB flaw lets a privileged local user crash the databaseRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server: InnoDB flaw lets a privileged user crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server: DDL flaw lets a privileged user crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.0MySQL Server: InnoDB flaw lets a privileged local user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.4MySQL Server: InnoDB flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server: Optimizer flaw lets a privileged user crash the serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.4MySQL Server: InnoDB flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5MySQL Server optimizer flaw lets low-privilege users crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.9MySQL Server Optimizer flaw lets a privileged user crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle Billing and Revenue Management: unauthenticated network flaw exposes readable and writable dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle Utilities Network Management System: unauthenticated read of some dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle Unified Inventory Management: unauthenticated network flaw exposes critical dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle Unified Inventory Management: low-privilege network attacker can take overVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.0Oracle Agile PLM for Process: flaw lets a low-privilege user take overVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.5Oracle GoldenGate: Vendor Access Module flaw exposes data to local low-privilege usersOther2026-10-20 22:18 UTCby NVD–WHAT TO DO LOW3.6Oracle TimesTen In-Memory Database: local low-privilege user can read and change some dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle VirtualBox 7.2.20: local low-privilege user can take over VirtualBoxInfrastructure2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.8Oracle VirtualBox: low-privilege local user can take over VirtualBoxInfrastructure2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle ZFS Storage Appliance Kit: unauthenticated network flaw leaks a subset of dataInfrastructure2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Oracle Agile PLM for Process: low-privilege HTTP flaw allows full takeoverOracle Agile Product Lifecycle Management for ProcessPackage2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.4Oracle Agile PLM for Process: low-privilege user can read and change some dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Oracle Agile PLM for Process: low-privileged HTTP user can take over serverOther2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.3Oracle Agile PLM for Process: low-privilege network flaw enables data takeoverVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle Agile PLM for Process: low-privilege users can read and change some dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.3Oracle Agile PLM for Process: low-privilege users can read some dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO CRITICAL9.1Helidon MicroProfile security: unauthenticated HTTP attacker reads and changes datahelidon-microprofile-securityRuntime2026-10-20 22:18 UTCby InfraStack Analyst–FIX 4.5.6 MEDIUM5.3Oracle Utilities Network Management System: unauthenticated read of a subset of dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.3Helidon WebSocket flaw lets unauthenticated network attackers read some dataRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.3Helidon HTTP/1 web client: unauthenticated request can cause partial denial of servicePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.3Helidon: unauthenticated network attacker gets read access to some dataRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.2Helidon: CORS component flaw lets unauthenticated remote attackers alter dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Helidon WebSocket client flaw lets unauthenticated attackers read data and cause partial denial of servicePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.0Helidon: unauthenticated HTTP requests can modify data and cause partial denial of serviceRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.8Helidon Vault integration: unauthenticated network attacker reads some Helidon dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Helidon: DNS round-robin resolver flaw lets network attackers alter data and disrupt servicePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.8Helidon: JWT security provider flaw allows unauthorized read of some dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.2Helidon gRPC server flaw lets unauthenticated remote attackers alter dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.3Helidon: Google login security provider lets unauthenticated users read some dataRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO LOW3.1Helidon: CORS component flaw allows limited data changes via HTTPRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO LOW3.7Helidon: LRA component flaw allows limited unauthorized data reads over HTTPRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Helidon: LRA component flaw lets unauthenticated remote attackers modify dataRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.9Helidon OIDC flaw lets remote attackers reach critical dataRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.8Helidon: HTTP auth provider flaw exposes data to unauthenticated network attackersPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Helidon HTTP/2 client flaw lets unauthenticated attackers crash or hang serviceshelidon-webclient-http2Package2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.6Helidon: IDCS mapper flaw exposes data to low-privileged local usersRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO LOW3.7Helidon: HTTP/2 flaw lets unauthenticated network attacker partly crash serverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Helidon: concurrency-limits flaw allows unauthenticated data changes and partial denial of serviceRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.3Helidon: health component lets unauthenticated network users read some dataRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Oracle E-Business Suite Cost Management: low-privilege user can take over over HTTPOracle E-Business Suite Cost ManagementRuntime2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.8Oracle E-Business Suite: Application Object Library flaw lets local users take overPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.2Oracle Agile PLM 9.3.6: Import component flaw exposes critical data locallyVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle Agile PLM: Acollect flaw exposes data to unauthenticated network attackersVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle Agile PLM: unauthenticated network flaw exposes critical data over HTTPVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.1Oracle Commerce Platform: low-privilege network attacker can modify critical dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite Purchasing: PO View Document flaw exposes purchasing dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.1Oracle E-Business Suite Purchasing: Approvals flaw exposes and changes some dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Oracle E-Business Suite Purchasing: low-privilege web user can take over modulePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite Payroll: low-privilege network attacker can take overOracle E-Business Suite PayrollVendor2026-10-20 22:18 UTCby InfraStack Analyst–FIX October 2026 CPU patch (number in MOS)HIGH7.5Oracle E-Business Suite Payroll: low-privilege HTTP attack can take overVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite Payroll: low-privileged network attacker can take overVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite Payroll: low-privileged user can alter payroll dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite: Flexfields flaw lets low-privilege users take over Application Object LibraryVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite: unauthenticated network flaw exposes Applications Manager dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.8Oracle Application Testing Suite: OpenScript flaw lets a local low-privilege user take overOracle Application Testing SuiteOther2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO HIGH7.0Oracle Application Testing Suite: OpenScript flaw lets local users take overOther2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.1Oracle Demand Planning: unauthenticated HTTP flaw lets attackers read and change dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite: Materials Requirement Planning flaw allows takeover over HTTPPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.0Oracle E-Business Suite: Inventory Management flaw lets local users take overPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.0Oracle E-Business Suite Payroll: local low-privilege user can take over modulePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle E-Business Suite Capacity: low-privilege network attacker can take overVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Oracle E-Business Suite Capacity: low-privilege HTTP attack takes over the appOracle E-Business Suite (Capacity)Vendor2026-10-20 22:18 UTCby InfraStack Analyst–FIX Oct 2026 CPU, patch 40022426:12.2.0 (per Rapid7, unconfirmed by Oracle)HIGH7.7Oracle E-Business Suite Capacity: low-privilege network attack exposes critical dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.7Oracle E-Business Suite Capacity: low-privilege network attacker reads critical dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite Payroll: low-privilege network user can read payroll dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle E-Business Suite: Order Management flaw exposes data to low-privileged usersVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO CRITICAL9.8Oracle Solaris 11.4: unauthenticated network flaw in Utility gives full takeoverOracle SolarisInfrastructure2026-10-20 22:18 UTCby InfraStack Analyst–FIX 11.4 SRU96 (96.227.1)HIGH7.5Oracle E-Business Suite Cost Management: low-privilege HTTP flaw allows full takeoverPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle Sales Foundation: low-privileged network user can take over the productVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.5Oracle E-Business Suite EDI Gateway: low-privileged HTTP flaw exposes critical dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.6Oracle EDI Gateway: high-privilege network attacker can take over the productPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.2Oracle E-Business Suite EDI Gateway: remote takeover by a privileged userPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle Business Intelligence: unauthenticated HTTP access exposes all accessible dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO CRITICAL9.9Oracle Enterprise Manager: Data Guard flaw lets low-privilege user take over serverOracle Enterprise Manager for Oracle DatabaseOther2026-10-20 22:18 UTCby InfraStack Analyst–FIX 13.5 RU35 (13.5.0.35) per CPU Oct 2026, unconfirmed for this CVE CRITICAL9.9Oracle Enterprise Manager: Data Guard flaw lets low-privilege users take overOracle Enterprise Manager for Oracle DatabaseVendor2026-10-20 22:18 UTCby InfraStack Analyst–FIX unknown: see Oct 2026 CPU patch availability document HIGH7.8Oracle Enterprise Manager: install component flaw lets local users take overInfrastructure2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Oracle Enterprise Manager for Siebel: low-privilege network attacker takes over serverOracle Enterprise Manager for SiebelOther2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8Oracle Enterprise Manager for Siebel: low-privilege network flaw allows full takeoverOracle Enterprise Manager for SiebelRuntime2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.6Oracle Enterprise Manager: Security Framework flaw lets unauthenticated HTTP attackers alter dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.5Oracle TimesTen In-Memory Database: low-privilege local user reads protected dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO CRITICAL9.8Oracle APEX: unauthenticated network flaw lets attackers take over the appOracle APEXPackage2026-10-20 22:18 UTCby InfraStack Analyst–FIX 24.1.22 HIGH7.5Oracle OUI Framework: unauthenticated HTTP request can crash installer serviceVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.2Oracle EDI Gateway: high-privilege network attacker can take over the productPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH8.8Oracle Enterprise Manager: low-privilege HTTP request lets attackers take over the platformOracle Enterprise Manager Base PlatformPackage2026-10-20 22:18 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.5Oracle Utilities Network Management System: local low-privilege user reads critical dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle Java SE and GraalVM: unauthenticated network flaw exposes data read and writeRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle WebLogic Server: unauthenticated HTTP flaw exposes critical dataRuntime2026-10-20 22:18 UTCby NVD–WHAT TO DO LOW3.8MySQL Cluster InnoDB flaw lets physical attackers crash the databasePackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle Database Server: low-privilege HTTP attacker can read RDBMS dataPackage2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.3Oracle Enterprise Manager: Metadata Plugin flaw leaks some stored dataVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM4.4Oracle Database: Oracle Net Services flaw lets a local admin crash the listenerInfrastructure2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.5Oracle Siebel CRM Integration: unauthenticated HTTP request can crash the EAI serviceVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle Trusted Answer Search: PLSQL flaw exposes data to low-privileged network usersVendor2026-10-20 22:18 UTCby NVD–WHAT TO DO HIGH7.7Oracle Trusted Answer Search: flaw exposes data to low-privileged network attackersVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH8.7Oracle Trusted Answer Search: low-privilege web flaw exposes data and changesOracle Trusted Answer SearchVendor2026-10-20 22:17 UTCby InfraStack Analyst–FIX October 2026 CPU HIGH7.6Oracle Trusted Answer Search: Application expert UI flaw lets low-privileged users access dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO CRITICAL9.9Oracle Trusted Answer Search: PLSQL flaw lets low-privilege users take overOracle Trusted Answer Search1 talkingVendor2026-10-20 22:17 UTCby InfraStack Analyst1talkingWHAT TO DO MEDIUM5.0Oracle Trusted Answer Search: PL/SQL flaw lets a logged-in user alter dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO CRITICAL9.9Oracle Trusted Answer Search: low-privilege network user can modify, delete or crashOracle Trusted Answer SearchOther2026-10-20 22:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5Oracle OPatchAuto: local high-privilege attacker can take over the toolVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO CRITICAL9.8Oracle WebCenter Sites: unauthenticated network flaw allows full takeoverOracle WebCenter SitesPackage2026-10-20 22:17 UTCby InfraStack Analyst–FIX Oct 2026 CPU patch HIGH8.1Oracle Trusted Answer Search: PL/SQL flaw lets unauthenticated network attacker take overVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM4.3Oracle Identity Manager: Connector Framework flaw allows partial denial of servicePackage2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH8.8Oracle Siebel CRM: unauthenticated network flaw allows full takeoverVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.7Oracle REST Data Services: low-privilege HTTP flaw exposes critical dataPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle REST Data Services: low-privilege HTTP user can read and change some dataPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM4.7Oracle Siebel CRM Integration: Open Integration flaw exposes some CRM dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.0Oracle PeopleSoft PeopleTools Query flaw leaks some accessible data to low-privileged usersVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.1Oracle PeopleSoft PeopleTools Fluid Core: unauthenticated XSS-style data change via HTTPVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM4.3Oracle PeopleSoft PeopleTools: Portal flaw leaks some stored data to low-privileged usersPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle PeopleSoft PeopleTools: Business Interlink flaw leaks data, partial denial of serviceVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle PeopleSoft PeopleTools Portal: low-privilege users can alter some dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle PeopleSoft PeopleTools: Fluid Core flaw allows limited data read and writeVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle Autonomous Health Framework: Trace File Analyzer flaw exposes data to local usersInfrastructure2026-10-20 22:17 UTCby NVD–WHAT TO DO CRITICAL9.8Oracle Secure Backup: unauthenticated network attacker can take over serverOracle Secure BackupInfrastructure2026-10-20 22:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5Oracle Secure Backup: low-privileged local user can crash backup serviceInfrastructure2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.8Oracle Secure Backup: low-privileged local user can take over the backup serverInfrastructure2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH8.8Oracle Secure Backup: low-privilege local user can take over backup serverOracle Secure BackupInfrastructure2026-10-20 22:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.3Oracle Secure Backup: NDMP daemon flaw leaks some backup data to network attackersVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH8.6Oracle Secure Backup: unauthenticated network crash causes denial of serviceOracle Secure BackupPackage2026-10-20 22:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.8Oracle Autonomous Health Framework: local low-privilege user can take overVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.8Oracle Autonomous Health Framework: local low-privilege user can take overPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM4.3Oracle Siebel CRM Marketing: unauthenticated flaw allows limited data changesVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle Primavera Unifier: logging flaw exposes critical data to low-privileged usersVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle Agile PLM for Process: Product Quality Management flaw exposes critical dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH8.1Oracle Agile PLM for Process: unauthenticated HTTP flaw allows full takeoverOther2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.5Oracle Product Lifecycle Analytics 3.6.1: installation flaw exposes data to local loginsPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.1Oracle Product Lifecycle Analytics 3.6.1: local low-privilege user gains data accessVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.0Oracle Product Lifecycle Analytics 3.6.1: installation flaw lets admins alter dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.5Oracle Product Lifecycle Analytics 3.6.1: installation flaw allows full takeoverVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.5Oracle Siebel CRM Cloud Gateway flaw exposes CRM data to unauthenticated network attackersVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.4Oracle Siebel CRM End User: Portal Framework flaw exposes critical data over HTTPSSiebel CRM End UserVendor2026-10-20 22:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.2Oracle EDI Gateway in E-Business Suite: network takeover by privileged userVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.3Oracle Siebel CRM Deployment: low-privileged local user can alter critical dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.1Oracle Siebel CRM Deployment: local low-privilege users can read and change dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.5Oracle Siebel CRM End User: unauthenticated HTTP flaw exposes critical dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.5Oracle Siebel CRM Deployment: low-privilege logon exposes critical dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.5Oracle Siebel CRM Deployment: unauthenticated HTTP flaw exposes critical dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.5Oracle Siebel CRM Deployment: unauthenticated network flaw exposes critical dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH8.3Oracle Siebel CRM Deployment: low-privilege HTTP flaw exposes critical dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH8.2Oracle Siebel CRM Deployment: unauthenticated HTTP flaw exposes and alters CRM dataOther2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH8.8Oracle Siebel Life Sciences eDetailing: low-privileged SQL flaw allows full takeoverSiebel Apps - Life Sciences (eDetailing)Vendor2026-10-20 22:17 UTCby InfraStack Analyst–FIX October 2026 CPU patch (26.10 inferred)MEDIUM6.0Oracle Siebel CRM Development: local high-privilege flaw exposes CRM dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.3Oracle Siebel CRM Development: scripting flaw exposes data to low-privileged logged-in usersVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.1Oracle Siebel CRM Development: low-privilege user can modify critical dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.7Oracle Siebel CRM Deployment: local high-privilege user can take over serverVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.8Oracle Autonomous Health Framework: local low-privilege users can take over the toolOther2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH8.7Oracle Siebel Life Sciences Web UI flaw lets low-privilege users take over dataSiebel Life SciencesVendor2026-10-20 22:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.1Oracle PeopleSoft PeopleTools: Integration Broker flaw exposes critical dataPeopleSoft Enterprise PeopleToolsVendor2026-10-20 22:17 UTCby InfraStack Analyst–FIX unknown (October 2026 CPU patch)LOW2.4Oracle Siebel CRM Deployment: physical access leaks a subset of dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle Siebel CRM Deployment: unauthenticated read of some stored dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.1Oracle Siebel CRM Development: Workflow flaw allows takeover over HTTPVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO CRITICAL9.9Oracle Siebel CRM Cloud: low-privilege HTTP attacker takes over the serviceSiebel CRM Cloud ApplicationsVendor2026-10-20 22:17 UTCby InfraStack Analyst–FIX see Oracle CPU Oct 2026 (26.10 per Armis, unconfirmed)LOW3.6Oracle Siebel CRM Cloud: local low-privilege flaw exposes some data to changeVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.5Oracle Siebel CRM Cloud Manager: low-privileged user reads critical dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle Siebel CRM Cloud: low-privilege LDAP flaw exposes critical dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO LOW3.1Oracle Siebel CRM Cloud: low-privilege users can read a subset of dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle Siebel CRM Cloud: Cloud Manager flaw exposes data to adjacent-network attackersVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle Siebel CRM Cloud: adjacent-network flaw exposes CRM dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle Siebel CRM Cloud: unauthenticated LDAP access exposes CRM dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH8.0Oracle Siebel CRM Cloud: adjacent-network flaw lets unauthenticated attacker alter dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.6Oracle Siebel CRM Cloud Manager: high-privilege HTTP flaw alters critical dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM4.1Oracle Siebel CRM Cloud: high-privilege local attacker can read critical dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.6Oracle PeopleSoft PeopleTools: low-privilege local user can disrupt and read dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.6Oracle PeopleSoft PeopleTools: unauthenticated HTTP flaw allows data changes and crashesVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle PeopleSoft PeopleTools: Test Framework flaw leaks some accessible dataPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle PeopleSoft PeopleTools: Test Framework flaw lets low-privileged users change dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH8.7PeopleSoft PeopleTools: Test Framework flaw lets low-privilege user alter dataOther2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.2Oracle PeopleSoft PeopleTools: Test Framework flaw exposes critical data locallyPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.0Oracle PeopleSoft PeopleTools: SQR component flaw allows takeover by local attackerPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.5Oracle PeopleSoft PeopleTools: SQR flaw lets low-privilege users take overRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH8.1Oracle PeopleSoft PeopleTools: Report Distribution flaw lets unauthenticated users modify dataPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.9Oracle PeopleSoft PeopleTools: SQR flaw lets insider alter data or crash serviceRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO LOW2.5Oracle PeopleSoft PeopleTools: SQR component flaw leaks some stored dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.8Oracle PeopleSoft PeopleTools: Report Distribution flaw exposes data to privileged usersVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM4.3Oracle PeopleSoft PeopleTools: low-privilege users can read some report dataPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH8.1Oracle PeopleSoft PeopleTools: Report Distribution flaw lets low-privilege users alter dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.5Oracle PeopleSoft PeopleTools: unauthenticated HTTP flaw exposes critical dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO CRITICAL9.6Oracle PeopleSoft PeopleTools: SQR component flaw lets low-privileged users reach all dataPeopleSoft Enterprise PeopleToolsOther2026-10-20 22:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.5Oracle PeopleSoft PeopleTools: SQR component flaw exposes data over HTTPVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.5Oracle PeopleSoft PeopleTools: Report Distribution flaw exposes data to low-privileged usersVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO LOW3.7Oracle PeopleSoft PeopleTools: Tuxedo flaw leaks a subset of dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.5Oracle PeopleSoft PeopleTools: PsAdmin flaw allows full takeover from adjacent networkPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO LOW3.1Oracle PeopleSoft PeopleTools: Analytic Server flaw allows partial denial of servicePackage2026-10-20 22:17 UTCby NVD–WHAT TO DO LOW2.9Oracle PeopleSoft PeopleTools: local logon lets attacker alter some dataPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle PeopleSoft PeopleTools: Analytic Server flaw lets low-privilege users crash serviceVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.8Oracle PeopleSoft PeopleTools: Analytic Server flaw lets local low-privilege users modify dataPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH8.1Oracle PeopleSoft PeopleTools: Business Interlink flaw allows unauthenticated takeover over HTTPVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.5Oracle PeopleSoft PeopleTools: Business Interlink flaw allows takeover over HTTPPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.5Oracle PeopleSoft PeopleTools: unauthenticated HTTP flaw exposes critical dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.1Oracle Siebel Marketing: Email Marketing flaw exposes CRM data to edits and readsVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.5Oracle PeopleSoft PeopleTools: Change Assistant flaw exposes data over HTTPVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO LOW3.7Oracle Siebel Marketing: unauthenticated read of a subset of dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM4.8Oracle Siebel CRM Marketing: unauthenticated HTTPS flaw allows limited data read and changeVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO LOW3.9Oracle Siebel CRM Marketing: privileged local user can alter some dataOther2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle Siebel Marketing: Email Marketing flaw exposes data to unauthenticated attackersVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO LOW3.7Oracle Siebel Marketing: Email Marketing flaw allows partial denial of serviceVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO LOW2.9Oracle Siebel Marketing: local attacker can cause partial denial of serviceOther2026-10-20 22:17 UTCby NVD–WHAT TO DO LOW2.9Oracle Siebel Marketing: local attacker can cause partial denial of serviceVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle Siebel CRM Marketing: unauthenticated SMTP request causes partial denial of serviceVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.6Oracle E-Business Suite Capacity: low-privilege HTTP access exposes critical dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO LOW2.2Oracle Siebel CRM Marketing: high-privilege user can read some dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM4.7Oracle Siebel CRM Marketing: low-privilege users can modify critical dataPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.1Oracle Siebel CRM Marketing: unauthenticated HTTP flaw exposes and alters some dataPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle Siebel Marketing: unauthenticated HTTP flaw allows limited data changesVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM4.3Oracle Siebel CRM Marketing: unauthenticated flaw allows limited data changesVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.5Oracle Siebel Marketing: low-privilege user can read critical CRM dataPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.1Oracle Siebel CRM Marketing: unauthenticated HTTP flaw exposes and alters some dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH8.1Oracle PeopleSoft PeopleTools: Business Interlink flaw allows unauthenticated server takeoverVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle PeopleSoft PeopleTools: unauthenticated HTTP request can crash Business InterlinkVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.1Oracle PeopleSoft PeopleTools: Portal flaw exposes data to low-privilege usersVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO HIGH7.6Oracle E-Business Suite Capacity: low-privilege HTTP attacker reads and changes dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM4.2Oracle REST Data Services: low-privilege users can read and change some dataPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM4.9Oracle REST Data Services: high-privilege users can modify critical dataRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.0Oracle REST Data Services: low-privileged users read some protected data over HTTPRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle REST Data Services: unauthenticated HTTP flaw exposes and alters some dataRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM4.2Oracle REST Data Services: low-privilege HTTP user can read and modify some dataPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle REST Data Services: ADP flaw lets low-privileged users change dataPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle REST Data Services: flaw in ADP lets low-privilege users read and change dataRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle REST Data Services: unauthenticated HTTP request reads a subset of dataRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM4.3Oracle REST Data Services: low-privilege users can modify some data over HTTPRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO LOW2.7Oracle REST Data Services: Database Actions flaw allows partial denial of serviceRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM4.7Oracle REST Data Services: Database Actions flaw allows data changes and partial denial of serviceRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.3Oracle REST Data Services: low-privilege users can read, change and delete dataVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.9Oracle REST Data Services: unauthenticated write access to data over HTTPRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO LOW2.4Oracle REST Data Services: high-privilege user can alter some stored dataRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO LOW3.7Oracle REST Data Services: unauthenticated read of some accessible dataRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO LOW3.1Oracle REST Data Services: core flaw lets privileged users alter some dataPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO LOW3.1Oracle REST Data Services: unauthenticated read of some data over HTTPPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.1Oracle REST Data Services: Backend-as-a-Service flaw exposes data to unauthenticated attackersRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle REST Data Services: unauthenticated request lets attackers read and change some dataRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle REST Data Services: ADP flaw allows data read and write over HTTPPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM4.3Oracle REST Data Services: low-privilege users can read some protected dataRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM4.7Oracle REST Data Services: high-privilege user can alter and read dataRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle REST Data Services: Database Actions flaw exposes data to low-privilege usersVendor2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle REST Data Services: GraphQL flaw leaks some accessible dataPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM6.9Oracle REST Data Services: unauthenticated flaw lets attackers change and read dataRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM4.2Oracle REST Data Services: low-privileged user can read and change some dataRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.4Oracle REST Data Services: low-privilege HTTP user can read and change some dataPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUM5.3Oracle REST Data Services: unauthenticated HTTP request can alter some stored dataRuntime2026-10-20 22:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDGPAC MP4Box: crafted MP4 file crashes the tool via floating-point exceptionPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDGPAC MP4Box: crafted file causes segmentation fault and denial of servicePackage2026-10-20 22:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDGPAC MP4Box: crafted media file overflows AC-4 parser, crashes itPackage2026-10-20 22:17 UTCby NVD–WHAT TO DO LOWINCIDENTSupabase: Projects stuck in restarting stateSupabaseVendor2026-10-20 21:59 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in tellyo-colours (npm)tellyo-coloursPackage2026-10-20 21:44 UTCby osv-malicious–UNINSTALL CRITICAL9.1TOTOLINK X2000R router: crafted request overflows stack and runs codeTOTOLINK X2000R firmwareInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: authenticated file upload lets attackers run codeX2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: upload handler overflow lets authenticated attacker run codeX2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: crafted HTTP request runs OS commandsX2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: stack overflow in formFilter lets attackers run codeTOTOLINK X2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: stack overflow in formFilter lets attacker run codeTOTOLINK X2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO NOT SCOREDNOT SCOREDlibcurl: effective URL option can leak credentials not present in inputPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDcurl: HTTP redirect with userinfo leaks Negotiate Kerberos ticket to third partiesRuntime2026-10-20 21:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDlibcurl: deeply nested multipart MIME crashes host process during cleanupPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDcurl: remote server can overwrite local files under -J flagPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDlibcurl: TFTP state flaw can leak POST upload data to malicious serversRuntime2026-10-20 21:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDlibcurl: failed FTP wildcard LIST leaves handle state corrupt, enabling memory corruptionPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDcurl: malicious FTP, IMAP, POP3 or SMTP server blocks transfers indefinitelyPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDcurl: long cookie from a remote server makes later cookie-jar reads drop cookiesPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDcurl with wolfSSL: pinned public key check can be bypassedPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDlibcurl: hashed known_hosts can misreport host key mismatch as missingPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDcurl: CRLF option lets uploaded IMAP data run as commandsPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDcurl: extreme HSTS max-age silently wipes the HSTS cache filePackage2026-10-20 21:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDcurl: HSTS import drops longer-lived child entries, allowing plaintext HTTP requestsPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDHTTP client: requests can reuse a connection authenticated for another originPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDlibcurl: cached Schannel connection reused across redirects, leaking client certificatePackage2026-10-20 21:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDlibcurl: malicious proxy can harvest origin credentials via CONNECT 401Package2026-10-20 21:17 UTCby NVD–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: overflow in IPv6 setup lets attackers run codeX2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: HTTP request overflow lets authenticated attacker run codeTOTOLINK X2000R firmwareInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: crafted request overflows stack and runs codeX2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: stack overflow in IPv6 setup lets attackers run codeTOTOLINK X2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: stack overflow in IPv6 setup lets attacker run codeTOTOLINK X2000R firmwareInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: IPv6 setup overflow lets attackers run codeTOTOLINK X2000R firmwareInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1Totolink X2000R router: stack overflow in IPv6 PPPoE setup lets attackers run codeTotolink X2000R firmwareInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1Totolink X2000R router: stack overflow in IPv6 PPPoE setup lets attackers run codeX2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: stack overflow in device-delete handler allows code executionTOTOLINK X2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: crafted request overflows stack and runs codeTOTOLINK X2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1Totolink X2000R router: crafted request runs OS commands as attackerTotolink X2000R firmwareInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: crafted request overflows stack and runs codeX2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1Totolink X2000R router: crafted request runs OS commands via formWscTotolink X2000R firmwareInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: crafted request runs OS commands as adminX2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: stack overflow in device hostname handler allows code executionTOTOLINK X2000R firmwareInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1Fastify middie: path-scoped middleware silently skipped, bypassing auth checksPackage2026-10-20 13:50 UTCby NVD–WHAT TO DO MEDIUM6.8PEAK-System PCAN driver: unvalidated object pointer dereference in type 0x4030 handlingInfrastructure2026-10-20 21:17 UTCby NVD–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: unsigned firmware accepted, enabling malicious firmware installTOTOLINK X2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: stack overflow in Mcli lets an attacker run codeTOTOLINK X2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: crafted upload request runs OS commandsTOTOLINK X2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: stack overflow in upload handler allows code executionTOTOLINK X2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLink X2000R router: heap overflow in upload handler allows code executionX2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: batchupg flaw lets an authenticated user run commandsX2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: batchupg overflow lets an attacker run codeTOTOLINK X2000R firmwareInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: stack overflow in web setup lets attackers run codeX2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1TOTOLINK X2000R router: crafted HTTP request runs OS commandsX2000RInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.8PEAK-System PCAN driver: malformed record parsing loop miscounts processed bytesInfrastructure2026-10-20 21:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDcurl: connection reuse ignores interface binding, sending traffic from wrong sourcePackage2026-10-20 21:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDcurl: GnuTLS builds let a malicious WebSocket server leak memoryPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO MEDIUM6.8PEAK-System PCAN driver: receive-record copy can exceed caller bufferInfrastructure2026-10-20 21:17 UTCby NVD–WHAT TO DO HIGH7.1PEAK-System PCAN parser: unchecked DLC overflows a stack bufferPEAK-System Device Driver SetupInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–FIX 5.1.4 MEDIUM6.8PEAK-System PCAN diagnostic call can overflow a caller-supplied output bufferInfrastructure2026-10-20 21:17 UTCby NVD–WHAT TO DO HIGH8.7EXPLOITEDEyeLock nano NXT: unauthenticated path traversal reads arbitrary local filesEyeLock nano NXTInfrastructure2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.7WordPress Cherry Plugin: unauthenticated file download reads wp-config.phpPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO MEDIUM6.1JavaMelody: reflected XSS in graph parameter runs script in browsersPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO CRITICAL9.2WordPress Issuu Panel plugin: unauthenticated file inclusion runs remote PHP codePackage2026-10-20 21:17 UTCby NVD–WHAT TO DO HIGH8.7WordPress Memphis Documents Library: unauthenticated path traversal reads wp-config.phpPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO HIGH8.8EXPLOITEDFooSun DotNetCMS: unauthenticated SQL injection leaks database contentsDotNetCMSOther2026-10-20 21:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.7WordPress Aspose PDF Exporter: path traversal lets anyone read wp-config.phpPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO HIGH8.7WordPress Aspose Importer plugin: unauthenticated file download exposes wp-config.phpPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO HIGH8.7WordPress Aspose Doc Exporter: unauthenticated file read exposes wp-config.phpPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO HIGH8.7ChurcHope WordPress theme: unauthenticated file download exposes wp-config.phpPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO HIGH8.7NativeChurch WordPress theme: path traversal lets anyone download wp-config.phpPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO MEDIUM6.1Blogroll Fun WordPress plugin: reflected XSS via 'k' parameterPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO MEDIUM6.1DedeCMS: reflected XSS in config.php lets attackers run script in browsersPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO MEDIUM6.1SocialFit WordPress plugin: reflected XSS in popup.php steals session cookiesPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO MEDIUM6.1K-news WordPress plugin: reflected XSS steals session cookies via 'ff' parameterPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO MEDIUM6.1Custom Tables WordPress plugin: reflected script injection steals visitor cookiesPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO HIGH8.7WordPress TinyMCE Thumbnail Gallery plugin: unauthenticated file read via path traversalPackage2026-10-20 21:17 UTCby NVD–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in hijok-lampam (PyPI)hijok-lampamPackage2026-10-20 20:59 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in trijigo-kalip (PyPI)trijigo-kalipPackage2026-10-20 20:59 UTCby osv-malicious–UNINSTALL MEDIUMNOT SCOREDPillow: EPS load(scale) lets Ghostscript render past the decompression bomb limitPillowPackage2026-10-20 20:53 UTCby GitHub Advisories–FIX 13.0.0 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in jiklpo-tsunari-kay (PyPI)jiklpo-tsunari-kayPackage2026-10-20 20:53 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in hijiko-pilaka (PyPI)hijiko-pilakaPackage2026-10-20 20:50 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in facewareretargeter (PyPI)facewareretargeterPackage2026-10-20 20:48 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTRender: Deploying from GitLab may intermittently failRenderVendor2026-10-20 20:48 UTCby status page–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Failures from a Subset of Twilio Alphanumeric Sender IDs to United Arab EmiratesTwilioVendor2026-10-20 20:45 UTCby status page–WHAT TO DO MEDIUMNOT SCORED@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035)@angular/commonPackage2026-10-20 20:37 UTCby GitHub Advisories–FIX 21.0.3 HIGH7.5markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0)markdown-itPackage2026-10-16 02:29 UTCby GitHub Advisories–FIX 14.3.3 NOT SCOREDNOT SCOREDcurl: Negotiate credentials forwarded to unrelated origin on redirectPackage2026-10-20 20:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDcurl: remote server cookie can wipe unrelated cookies from jar filePackage2026-10-20 20:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDcurl: pooled FTP connection reuse keeps a prior client certificate identityPackage2026-10-20 20:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDcurl: SSH host verification skipped when following redirects to SFTP or SCPPackage2026-10-20 20:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDcurl: clearing CURLOPT_AWS_SIGV4 leaves SigV4 auth active on the handlePackage2026-10-20 20:17 UTCby NVD–WHAT TO DO MEDIUM5.4Thunderbird: S/MIME decryption prompt race causes use-after-free crashPackage2026-10-20 20:17 UTCby NVD–WHAT TO DO MEDIUM5.3Thunderbird: malicious NTLM server leaks heap memory and crashes clientPackage2026-10-20 20:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDThunderbird: XMPP replies let remote users inject stanzas as the userPackage2026-10-20 20:17 UTCby NVD–WHAT TO DO MEDIUM5.9Thunderbird: account setup leaks user password over plain HTTPPackage2026-10-20 20:17 UTCby NVD–WHAT TO DO HIGH7.8virtualenv bash activate runs commands from an environment name with a backslash before $virtualenvPackage2026-10-12 01:57 UTCby GitHub Advisories–FIX 21.14.7 MEDIUM4.5virtualenv: Deletion recovery can change a symlink target's modevirtualenvPackage2026-10-17 16:10 UTCby GitHub Advisories–FIX 21.14.9 HIGH7.1virtualenv: Bash prompt values can change meaning under older compatibility modesvirtualenvPackage2026-10-17 16:10 UTCby GitHub Advisories–FIX 21.14.9 HIGH7.8virtualenv: Generated POSIX console launchers interpret destination paths as shell syntaxvirtualenvPackage2026-10-17 16:10 UTCby GitHub Advisories–FIX 21.14.9 MEDIUM4.5virtualenv: Generated files can follow existing destination linksvirtualenvPackage2026-10-17 16:10 UTCby GitHub Advisories–FIX 21.14.9 MEDIUM4.4virtualenv: Seeded files retain permissions from an older cachevirtualenvPackage2026-10-17 16:10 UTCby GitHub Advisories–FIX 21.14.9 MEDIUM4.5virtualenv: Seed replacement does not contain metadata deletion pathsvirtualenvPackage2026-10-17 16:10 UTCby GitHub Advisories–FIX 21.14.9 HIGH7.1virtualenv: Xonsh activation literals depend on the script decoding codecvirtualenvPackage2026-10-17 16:10 UTCby GitHub Advisories–FIX 21.14.9 LOW2.3virtualenv: Pip seeding with download omits wheel digest verificationvirtualenvPackage2026-10-17 16:10 UTCby GitHub Advisories–FIX 21.14.9 MEDIUM4.5virtualenv: Builtin creation follows linked environment directoriesvirtualenvPackage2026-10-17 16:10 UTCby GitHub Advisories–FIX 21.14.9 LOW2.0virtualenv: Venv configuration readback can reinterpret path boundariesvirtualenvPackage2026-10-17 16:10 UTCby GitHub Advisories–FIX 21.14.9 MEDIUM4.8War Thunder client sends auth token in LZ4-compressed plaintextOther2026-10-20 20:17 UTCby NVD–WHAT TO DO HIGH7.7MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another@modelcontextprotocol/serverAI agents & MCP2026-10-20 20:07 UTCby GitHub Advisories–FIX 2.3.0 HIGH7.5MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation@modelcontextprotocol/sdkAI agents & MCP2026-10-20 20:06 UTCby GitHub Advisories–FIX 1.32.0 MEDIUM6.8MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service@modelcontextprotocol/sdkAI agents & MCP2026-10-20 19:43 UTCby GitHub Advisories–FIX 1.32.0 LOWINCIDENTPlanetScale: Gap in dashboard metrics for AWS us-east-1PlanetScaleVendor2026-10-20 19:38 UTCby status page–WHAT TO DO CRITICALNOT SCOREDuv's bundled CA store trusts an emSign root whose intermediate CA keys are compromiseduvPackage2026-10-20 19:37 UTCby GitHub Advisories–FIX 0.13.4 MEDIUMINCIDENTCloudflare: Issue with Bot management traffic categorization for verified botsCloudflareVendor2026-10-20 19:35 UTCby status page–WHAT TO DO CRITICALNOT SCOREDcertifi bundles emSign root CAs with compromised intermediate CA keyscertifiPackage2026-10-20 19:35 UTCby GitHub Advisories–FIX 2026.10.19 NOT SCOREDNOT SCOREDXERJ Console: API bearer tokens can mint new persistent API tokensOther2026-10-20 19:19 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-75997 withdrawn: issued in error, no product affectedOther2026-10-20 19:18 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-75751 was withdrawn: issued in error, no vulnerabilityOther2026-10-20 19:18 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-75747 was withdrawn: issued in error, no flawOther2026-10-20 19:18 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-48279 withdrawn: issued in error, no vulnerabilityOther2026-10-20 19:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-21356 rejected by CNA as issued in errorOther2026-10-20 19:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-21270 was withdrawn; issued in error, no vulnerabilityOther2026-10-20 19:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-21266 withdrawn: issued in error, no vulnerabilityOther2026-10-20 19:17 UTCby NVD–WHAT TO DO HIGH7.0SNS enrollment Portal: stored XSS via captive portal certificate requestStormshield Network SecurityInfrastructure2026-10-20 19:17 UTCby InfraStack Analyst–FIX 4.8.20 LTSB HIGH7.1SNS enrollment Portal: stored XSS via captive portal user creationOther2026-10-20 19:17 UTCby NVD–WHAT TO DO LOW2.3virtualenv: Downloaded wheel selection and caching precede verificationvirtualenvPackage2026-10-17 16:10 UTCby GitHub Advisories–FIX 21.14.9 MEDIUM4.4virtualenv: Temporary app-data can leave dangling seed package linksvirtualenvPackage2026-10-17 16:21 UTCby GitHub Advisories–FIX 21.14.10 MEDIUM4.8Cachet has Stored XSS in Incident Componentcachethq/cachetPackage2026-08-27 10:25 UTCby GitHub Advisories–WHAT TO DO CRITICAL9.9Argo CD: repo-server runs attacker plugin through Helm when enabledInfrastructure2026-10-07 15:58 UTCby NVD–WHAT TO DO CRITICAL9.9Argo CD: crafted Kustomize remote URL runs commands in repo-serverInfrastructure2026-10-07 15:58 UTCby NVD–WHAT TO DO MEDIUM5.3EspoCRM: PDF image handling lets requests bypass authorization checksPackage2026-10-13 19:35 UTCby NVD–WHAT TO DO MEDIUM6.5SNS VPN log monitoring screen: stored cross-site scripting in log viewOther2026-10-20 19:17 UTCby NVD–WHAT TO DO HIGH8.8Acrobat for Edge: out-of-bounds write lets a malicious file run codeAcrobat for EdgeOther2026-10-20 19:17 UTCby InfraStack Analyst–FIX 154.0.4258.48 MEDIUM4.3Acrobat for Edge: out-of-bounds read can leak sensitive memory contentsOther2026-10-20 19:17 UTCby NVD–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @securihackbot/depconf-stage-1792484738 (npm)@securihackbot/depconf-stage-1792484738Package2026-10-20 18:45 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in rs-lookout-sandbox-poc (npm)rs-lookout-sandbox-pocPackage2026-10-20 18:45 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in memories-core-web (npm)memories-core-webPackage2026-10-20 18:45 UTCby osv-malicious–UNINSTALL HIGH8.6MCP TypeScript SDK: Experimental tasks were not tied to the session that created them@modelcontextprotocol/sdkAI agents & MCP2026-10-02 20:54 UTCby GitHub Advisories–FIX 1.32.0 MEDIUM6.5MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies@modelcontextprotocol/sdkAI agents & MCP2026-10-20 18:26 UTCby GitHub Advisories–FIX 1.32.0 HIGHINCIDENTSentry: Sentry.io not loadingSentryVendor2026-10-20 18:20 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in semvver (PyPI)semvverPackage2026-10-20 18:20 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in semveer (PyPI)semveerPackage2026-10-20 18:20 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in semmver (PyPI)semmverPackage2026-10-20 18:20 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in semverr (PyPI)semverrPackage2026-10-20 18:20 UTCby osv-malicious–UNINSTALL CRITICAL9.8Wavlink router firmware: unauthenticated remote command execution as rootWL-WN530BE1-A firmwareInfrastructure2026-10-20 18:17 UTCby InfraStack Analyst–WHAT TO DO HIGH7.5ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportapostrophePackage2026-10-02 13:24 UTCby GitHub Advisories–FIX 4.33.0 MEDIUM5.9ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password GuessingapostrophePackage2026-10-02 13:24 UTCby GitHub Advisories–FIX 4.33.0 CRITICAL9.9Argo CD: Jsonnet imports read any file on the repo-serverInfrastructure2022-05-18 13:08 UTCby NVD–WHAT TO DO LOW3.7ApostropheCMS: Missing Authorization on Notification PATCH/DELETE EndpointsapostrophePackage2026-10-02 13:24 UTCby GitHub Advisories–FIX 4.33.0 MEDIUM5.3ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test@apostrophecms/import-exportPackage2026-10-02 13:24 UTCby GitHub Advisories–FIX 3.7.0 MEDIUM5.4ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document@apostrophecms/import-exportPackage2026-10-02 13:24 UTCby GitHub Advisories–FIX 3.7.0 MEDIUM4.3ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft IdentifiersapostrophePackage2026-10-02 13:24 UTCby GitHub Advisories–FIX 4.33.0 MEDIUM6.1ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated usersapostrophePackage2026-10-02 13:24 UTCby GitHub Advisories–FIX 4.33.0 MEDIUM5.5aaPanel: spoofed X-Real-Ip header bypasses IP-based access controlsOther2026-10-20 18:17 UTCby NVD–WHAT TO DO CRITICAL9.9aaPanel: File Manager command injection lets logged-in users run OS commandsaaPanelRuntime2026-10-20 18:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.3Participants Database WordPress plugin: authorization bypass through user-controlled keyPackage2026-10-20 18:17 UTCby NVD–WHAT TO DO CRITICAL9.1Google ADK TypeScript: path traversal lets remote users read and write filesAI agents & MCP2026-09-29 17:18 UTCby NVD–WHAT TO DO MEDIUM5.4ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLssanitize-htmlPackage2026-10-02 13:24 UTCby GitHub Advisories–FIX 2.18.0 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in nwfp-build-config (npm)nwfp-build-configPackage2026-10-20 18:14 UTCby osv-malicious–UNINSTALL MEDIUM5.3ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)apostrophePackage2026-10-02 13:23 UTCby GitHub Advisories–FIX 4.33.0 MEDIUM5.3ApostropheCMS: Page REST API authorization bypassapostrophePackage2026-10-20 18:13 UTCby GitHub Advisories–FIX 4.33.0 MEDIUM4.3ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF@apostrophecms/ai-helperPackage2026-10-02 13:23 UTCby GitHub Advisories–FIX 1.0.0-beta.13 MEDIUM5.3ApostropheCMS: Cross-domain session token in URL confers session takeoverapostrophePackage2026-10-02 13:23 UTCby GitHub Advisories–FIX 4.33.0 MEDIUM5.3ApostropheCMS: CAPTCHA response token not URL-encoded@apostrophecms/formPackage2026-10-02 13:23 UTCby GitHub Advisories–FIX 1.5.5 HIGH7.1ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service@apostrophecms/db-connectPackage2026-10-02 13:23 UTCby GitHub Advisories–FIX 1.1.0 HIGH8.2follow-redirects array-form headers bypass cross-origin credential strippingfollow-redirectsPackage2026-10-01 13:52 UTCby GitHub Advisories–FIX 1.16.1 HIGH8.2@angular/router: Denial of Service via RouterLink Query Parameter Retention in Server-Side Rendering (SSR)@angular/routerPackage2026-10-01 05:33 UTCby GitHub Advisories–FIX 22.2.1 MEDIUM6.7Grafana: service account reads and changes users in other organizationsRuntime2026-10-20 17:17 UTCby NVD–WHAT TO DO MEDIUM4.4SolarWinds Patch Manager leaks sensitive data to local users, enabling privilege escalationOther2026-10-20 17:17 UTCby NVD–WHAT TO DO MEDIUM4.6SolarWinds Observability Self-Hosted: stored XSS runs script in other users' browsersOther2026-10-20 17:17 UTCby NVD–WHAT TO DO MEDIUM6.4SolarWinds Observability Self-Hosted: authenticated SSRF reaches internal network destinationsInfrastructure2026-10-20 17:17 UTCby NVD–WHAT TO DO HIGH8.8SolarWinds Observability Self-Hosted: broken authorization lets low-privileged users change dataSolarWinds Observability Self-HostedInfrastructure2026-10-20 17:17 UTCby InfraStack Analyst–FIX 2026.4 HIGH7.5ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryapostrophePackage2026-10-02 13:24 UTCby GitHub Advisories–FIX 4.33.0 LOW3.7ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)sanitize-htmlPackage2026-10-02 13:24 UTCby GitHub Advisories–FIX 2.18.0 MEDIUM5.3ApostropheCMS: Unauthenticated unbounded multipart upload → disk-exhaustion DoS@apostrophecms/formPackage2026-10-02 13:23 UTCby GitHub Advisories–FIX 1.5.5 MEDIUM4.3ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorizationapostrophePackage2026-10-02 13:23 UTCby GitHub Advisories–FIX 4.33.0 MEDIUM5.3ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content rendersanitize-htmlPackage2026-10-02 13:23 UTCby GitHub Advisories–FIX 2.18.0 MEDIUM6.9ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)apostrophePackage2026-10-02 13:24 UTCby GitHub Advisories–FIX 4.33.0 MEDIUM5.6ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)uploadfsPackage2026-10-02 13:24 UTCby GitHub Advisories–FIX 1.28.0 LOW3.3ApostropheCMS: Path traversal in uploadfsuploadfsPackage2026-10-02 13:24 UTCby GitHub Advisories–FIX 1.28.0 MEDIUM5.3ApostropheCMS sanitize-html: unbounded recursion when re-sanitizing the fallback of a discarded iframe (stack overflow, nestingLimit not enforced)sanitize-htmlPackage2026-10-14 18:26 UTCby GitHub Advisories–FIX 2.18.1 MEDIUM6.5ApostropheCMS: Import API bypasses publication roles for protected content@apostrophecms/import-exportPackage2026-10-14 18:26 UTCby GitHub Advisories–FIX 3.7.1 LOW3.1ApostropheCMS: Missing Authentication in `cleanExport` Route@apostrophecms/import-exportPackage2026-10-14 18:26 UTCby GitHub Advisories–FIX 3.7.1 MEDIUM4.3aaPanel: download endpoint path traversal reads files outside intended directoryRuntime2026-10-20 17:17 UTCby NVD–WHAT TO DO MEDIUM5.4ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute SerializationapostrophePackage2026-10-14 18:26 UTCby GitHub Advisories–FIX 4.34.0 MEDIUM4.3ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged usersapostrophePackage2026-10-14 18:26 UTCby GitHub Advisories–FIX 4.34.0 MEDIUMINCIDENTTwilio: SMS Delivery Delays from a Subset of Twilio Short Codes to Telnyx United StatesTwilioVendor2026-10-20 17:16 UTCby status page–WHAT TO DO MEDIUMINCIDENTFly.io: Capacity issues in GRU regionFly.ioVendor2026-10-20 16:54 UTCby status page–WHAT TO DO MEDIUMINCIDENTTwilio: Issue with Flex Agent Copilot Auto Wrap-up NotesTwilioVendor2026-10-20 16:53 UTCby status page–WHAT TO DO MEDIUMINCIDENTTwilio: SMS Delivery Delays from a Subset of Twilio Phone Numbers to Telstra AustraliaTwilioVendor2026-10-20 16:28 UTCby status page–WHAT TO DO HIGH8.5Cortex-A7 MMU port: buffer range check only tests first byteEclipse ThreadXRuntime2026-10-02 18:44 UTCby InfraStack Analyst–FIX 6.5.2.202603 MEDIUM6.8ThreadX: deleting a user-mode thread leaks its kernel stack, exhausting the poolRuntime2026-10-02 18:44 UTCby NVD–WHAT TO DO HIGH7.0ThreadX: unchecked size addition lets a module corrupt adjacent memoryInfrastructure2026-10-02 18:44 UTCby NVD–WHAT TO DO MEDIUM4.8ThreadX Module Manager: block-pool create reads memory past module boundsInfrastructure2026-10-02 18:44 UTCby NVD–WHAT TO DO HIGH8.5ThreadX: module deallocation frees kernel objects still in useRuntime2026-10-02 18:44 UTCby NVD–WHAT TO DO MEDIUM6.9Azure RTOS ThreadX: unbounded module object lookup in privileged modeInfrastructure2026-10-02 18:44 UTCby NVD–WHAT TO DO MEDIUM6.9ThreadX: Module Manager lets a module delete kernel objects it does not ownRuntime2026-10-02 18:44 UTCby NVD–WHAT TO DO HIGH8.8Web add-on HTTP server: one malformed PUT frees an uninitialized pointerNetX DuoOther2026-10-02 18:44 UTCby InfraStack Analyst–FIX 6.5.2.202603 CRITICAL9.3NetX Secure: oversized RSA certificate key overflows a static bufferNetX DuoRuntime2026-10-02 18:44 UTCby InfraStack Analyst–FIX 6.5.2.202603 MEDIUM6.9Web add-on HTTP server reads headers from request bodyOther2026-10-02 18:44 UTCby NVD–WHAT TO DO HIGH8.7NetX Secure: zero-length TLS certificate message reads past packet bufferNetX Duo (Eclipse ThreadX)Infrastructure2026-10-02 18:44 UTCby InfraStack Analyst–FIX 6.5.2.202603 HIGH8.7NetX Secure: TLS 1.3 Certificate parser reads heap memory out of boundsNetX Duo (Eclipse ThreadX)Infrastructure2026-10-02 18:44 UTCby InfraStack Analyst–FIX 6.5.2.202603 MEDIUM4.6GX multi-line text view reads one byte past buffer endPackage2026-10-02 18:44 UTCby NVD–WHAT TO DO HIGH8.1CouchDB: missing auth checks let any request read prefixed _user databasesPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO LOW1.3Apache CouchDB: unsafe deserialisation lets a user exhaust server memoryPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO LOW0.6Apache CouchDB: replicator loops forever on redirects, causing denial of servicePackage2026-10-20 16:17 UTCby NVD–WHAT TO DO HIGH7.7Apache CouchDB: unlimited gzip decompression lets remote clients exhaust memoryPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO CRITICAL9.3Apache CouchDB: unvalidated config value lets a server admin run shell commandscouchdbPackage2026-10-20 16:17 UTCby InfraStack Analyst–FIX 3.5.3 CRITICAL9.3SuggestArr: spoofed X-Forwarded-For grants unauthenticated admin accessPackage2026-10-20 15:24 UTCby NVD–WHAT TO DO MEDIUM6.1VPL for Moodle: reflected XSS in similarity diff pagePackage2026-10-20 16:17 UTCby NVD–WHAT TO DO CRITICAL9.1light-4j: empty-password Basic auth lets attackers log in as LDAP usersPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO MEDIUM6.8OpenImageIO: crafted Cineon file causes heap out-of-bounds read and crashPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO MEDIUM6.8HarfBuzz: crafted font crashes apps that shape text with itPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO HIGH7.3HarfBuzz: crafted font writes out of bounds in WebAssembly shaperPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO CRITICAL9.9Froxlor hosting panel: symlink flaw lets customers take root-owned directoriesfroxlorOther2026-10-20 07:24 UTCby InfraStack Analyst–FIX 2.3.15 MEDIUM5.4Froxlor: authenticated customers can delete reseller-provisioned main domains via APIOther2026-10-20 07:24 UTCby NVD–WHAT TO DO MEDIUM5.3Froxlor: resellers can read any admin record via Admins.getOther2026-10-20 07:24 UTCby NVD–WHAT TO DO CRITICAL9.2FlexGet: decompress plugin path traversal lets archives write filesPackage2026-08-24 12:26 UTCby NVD–WHAT TO DO MEDIUM5.4SparkyFitness: authenticated users can delete other users' food variantsPackage2026-07-09 15:39 UTCby NVD–WHAT TO DO MEDIUM6.9Outline: deleted admins keep receiving document contents via webhooksPackage2026-06-06 14:35 UTCby NVD–WHAT TO DO MEDIUM5.4Xen Orchestra: low-privileged users can alter other users' 2FA and credentialsInfrastructure2026-09-30 08:30 UTCby NVD–WHAT TO DO MEDIUM4.8Bandizip: extracted PowerShell scripts lose Mark-of-the-Web, bypassing execution warningsPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO MEDIUM6.0Moodle Configurable Reports block: SQL injection lets low-privileged users read database tablesPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO HIGH7.1Moodle Configurable Reports: authenticated users can read restricted reportsRuntime2026-10-20 16:17 UTCby NVD–WHAT TO DO HIGH7.1Stirling-PDF: authenticated users read and destroy other users' stored filesPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO HIGH8.6Stirling-PDF: admin SQL import bypass lets uploaded backup run Java codeStirling-PDFPackage2026-10-20 16:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.8Ghidra: crafted ELF file triggers out-of-memory denial of service on importPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO MEDIUM6.9x402 SIWX extension lets paid clients unlock unpaid routesPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO MEDIUM6.9json-smart: strict-mode validation bypass lets malformed JSON pass checksPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO MEDIUM5.3Memos: missing authorization lets any user read other users' activity recordsPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO MEDIUM5.4Fat Free CRM: any logged-in user can edit or delete others' commentsPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO MEDIUM5.4Modoboa: authenticated users can write auto-replies to other mailboxesPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO MEDIUM5.3Modoboa: authenticated users can delete other domains' alarmsPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO MEDIUM5.4Blinko: tag API lets logged-in users read and edit other users' tagsPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO LOW3.1Webstudio: missing authorization lets logged-in users read other projects' dataOther2026-10-20 16:17 UTCby NVD–WHAT TO DO MEDIUM5.3Sharkord: any signed-in member can replace the server logoPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO MEDIUM5.4Sharkord: any member can change server-wide settings without permissionPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO MEDIUM5.3Baserow: any logged-in user can read cells from other workspacesPackage2026-10-15 08:07 UTCby NVD–WHAT TO DO MEDIUM6.5ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content@apostrophecms/import-exportPackage2026-10-14 18:26 UTCby GitHub Advisories–FIX 3.7.1 MEDIUM6.5ApostropheCMS: Import archives can exhaust server storage and deny service@apostrophecms/import-exportPackage2026-10-14 18:26 UTCby GitHub Advisories–FIX 3.7.1 MEDIUM5.3ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST APIapostrophePackage2026-10-14 18:26 UTCby GitHub Advisories–FIX 4.34.0 MEDIUM6.0ApostropheCMS: Exposure of Sensitive Information via predictable export filenames@apostrophecms/import-exportPackage2026-10-14 18:26 UTCby GitHub Advisories–FIX 3.7.1 MEDIUM4.3ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated userapostrophePackage2026-10-14 18:26 UTCby GitHub Advisories–FIX 4.34.0 MEDIUM5.4ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefixapostrophePackage2026-10-14 18:26 UTCby GitHub Advisories–FIX 4.34.0 MEDIUM5.9Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix@vitest/mockerPackage2026-10-16 07:59 UTCby GitHub Advisories–FIX 4.1.12 MEDIUM4.7Vitest: Code injection via unauthenticated manual mock registration@vitest/mockerPackage2026-10-16 07:59 UTCby GitHub Advisories–FIX 4.1.12 MEDIUM6.5Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file@vitest/ui1 talkingPackage2026-10-16 07:59 UTCby GitHub Advisories1talkingFIX 5.0.5 MEDIUM6.3Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`vitePackage2026-10-06 14:15 UTCby GitHub Advisories–FIX 8.3.3 MEDIUM6.3Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machinevitePackage2026-10-06 14:15 UTCby GitHub Advisories–FIX 8.3.3 LOW2.1Vite: Cross origin script execution through Vite custom middlewarevitePackage2026-10-06 14:15 UTCby GitHub Advisories–FIX 8.3.3 MEDIUM6.5SureCart WordPress plugin: stored XSS through input handling up to 4.9.5Package2026-10-20 16:17 UTCby NVD–WHAT TO DO HIGH8.8VikRentCar WordPress plugin: CSRF lets attackers act as adminvikrentcarPackage2026-10-20 16:17 UTCby InfraStack Analyst–FIX 1.4.9 MEDIUM5.3Booktics WordPress plugin: missing authorization lets users reach restricted functionsPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO MEDIUM5.3Bus Ticket Booking WordPress plugin: missing authorization check through 5.9.7Package2026-10-20 16:17 UTCby NVD–WHAT TO DO MEDIUM4.3WP User Manager: missing authorization lets users change other users' statePackage2026-10-20 16:17 UTCby NVD–WHAT TO DO MEDIUM6.5Rootblox WordPress theme: stored XSS through unsanitized inputOther2026-10-20 16:17 UTCby NVD–WHAT TO DO HIGH7.5A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fixorg.a2aproject.sdk:a2a-java-sdk-http-client-androidAI agents & MCP2026-08-28 07:46 UTCby GitHub Advisories–FIX 1.3.2.Final HIGH7.5A2A Java SDK has a fail-open default task authorizationorg.a2aproject.sdk:a2a-java-sdk-server-commonAI agents & MCP2026-08-28 07:46 UTCby GitHub Advisories–FIX 1.3.0.Final MEDIUM5.7A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirectorg.a2aproject.sdk:a2a-java-sdk-parentAI agents & MCP2026-08-28 07:46 UTCby GitHub Advisories–FIX 1.3.0.Final MEDIUM6.5Meta Box WordPress plugin: missing authorization check exposes restricted actionsPackage2026-10-20 16:17 UTCby NVD–WHAT TO DO MEDIUM6.0Apache CouchDB: replicator database leaks other users' replication credentialsPackage2026-10-20 16:16 UTCby NVD–WHAT TO DO HIGH7.1Raptor RDF library: heap overflow from long language tags in RDF documentsPackage2026-10-20 16:16 UTCby NVD–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in unicode-title-normalizer (npm)unicode-title-normalizerPackage2026-10-20 15:59 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in formatting-subtitles-for-claude (npm)formatting-subtitles-for-claudePackage2026-10-20 15:59 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTCircleCI: Increased wait times for macOS jobs on m4pro.largeCircleCIVendor2026-10-20 15:58 UTCby status page–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in security-research-startup-snapshot-810764b303 (PyPI)security-research-startup-snapshot-810764b303Package2026-10-20 15:54 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in research-probe-6150c1c915 (PyPI)research-probe-6150c1c915Package2026-10-20 15:52 UTCby osv-malicious–UNINSTALL MEDIUMINCIDENTTwilio: WhatsApp Embedded Signup Configuration FailuresTwilioVendor2026-10-20 15:43 UTCby status page–WHAT TO DO MEDIUM6.8Eclipse OpenJ9: crafted dump bundle leaks local files from analyst machineRuntime2026-10-20 15:17 UTCby NVD–WHAT TO DO MEDIUM5.2USBX host: malicious MTP/PTP device reads past heap bufferInfrastructure2026-10-02 18:45 UTCby NVD–WHAT TO DO HIGH7.8thefuck: local attacker runs arbitrary code through rule loadingthefuckPackage2026-10-20 15:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM4.8ThreadX: front-send queue check reads past module buffer in privileged modeInfrastructure2026-10-02 18:44 UTCby NVD–WHAT TO DO MEDIUM6.8GUIX JPEG decoder: truncated markers read past buffer, zero sampling hangsPackage2026-10-02 18:44 UTCby NVD–WHAT TO DO MEDIUM6.8GUIX theme loader: crafted resource file writes past pixelmap tableOther2026-10-02 18:44 UTCby NVD–WHAT TO DO MEDIUM6.8GUIX embedded GUI library: binary resource loader reads past buffer endPackage2026-10-02 18:44 UTCby NVD–WHAT TO DO HIGH7.2Flatpak: crafted architecture name lets local user write root-owned filesInfrastructure2026-08-11 13:10 UTCby NVD–WHAT TO DO HIGH7.1GUIX font loader: malformed glyph range causes heap overflowGUIX (Eclipse ThreadX)Other2026-10-02 18:45 UTCby InfraStack Analyst–FIX 6.5.2.202603 HIGH8.4PNG decoder: a repeated IHDR chunk causes out-of-bounds memory writesguixPackage2026-10-02 18:45 UTCby InfraStack Analyst–FIX 6.5.2.202603 MEDIUM6.8GUIX JPEG decoder: out-of-order markers let a file overread memoryPackage2026-10-02 18:44 UTCby NVD–WHAT TO DO MEDIUM5.5MinIO: hard-coded cryptographic key in embedded console session authPackage2026-10-20 15:17 UTCby NVD–WHAT TO DO HIGH7.5Nerimity Desktop: crafted URL passed to shell.openExternal lets remote attackers actPackage2026-10-20 15:17 UTCby NVD–WHAT TO DO HIGH7.4DrayTek Vigor2960 router: IPsec certificate request enables remote command injectionInfrastructure2026-10-20 15:17 UTCby NVD–WHAT TO DO MEDIUM6.3launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editorslaunch-editorPackage2026-10-06 14:15 UTCby GitHub Advisories–FIX 2.14.2 MEDIUM6.3launch-editor: escapeCmdArgs() omits % escaping on Windowslaunch-editorPackage2026-10-06 14:15 UTCby GitHub Advisories–FIX 2.14.2 HIGH7.5launch-editor: `fs.existsSync()` existence check can be bypassed on Windowslaunch-editorPackage2026-10-06 14:15 UTCby GitHub Advisories–FIX 2.14.2 LOW3.3filelock: SoftReadWriteLock follows a lock tree swapped in after its first acquire and writes lock records into directories of the user running the locktox-dev filelockPackage2026-10-17 16:49 UTCby GitHub Advisories–FIX 4.2.1 HIGH7.1ANT-2026-KMJ2575Jfilelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own filesfilelockPackage2026-10-17 16:49 UTCby GitHub Advisories–FIX 4.2.1 MEDIUM4.7filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable markertox-dev filelockPackage2026-10-17 16:49 UTCby GitHub Advisories–FIX 4.2.1 MEDIUM6.1filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory nametox-dev filelockPackage2026-10-17 16:49 UTCby GitHub Advisories–FIX 4.2.1 MEDIUM6.1filelock: ReadWriteLock follows a symlink at the lock path into SQLitetox-dev filelockPackage2026-10-17 16:49 UTCby GitHub Advisories–FIX 4.0.9 MEDIUM4.7filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holderstox-dev filelockPackage2026-10-17 16:49 UTCby GitHub Advisories–FIX 4.2.1 MEDIUM6.1filelock: SoftReadWriteLock holder refresh writes through a hard link and hangs on a named pipe that another local user renames over its recordtox-dev filelockPackage2026-10-17 16:49 UTCby GitHub Advisories–FIX 4.2.1 MEDIUM5.5filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeouttox-dev filelockPackage2026-10-17 16:49 UTCby GitHub Advisories–FIX 4.2.1 MEDIUM5.3filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directoryfilelockPackage2026-10-17 16:49 UTCby GitHub Advisories–FIX 4.2.1 LOW2.5filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock takertox-dev filelockPackage2026-10-17 16:49 UTCby GitHub Advisories–FIX 4.2.1 MEDIUM6.3filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusiontox-dev filelockPackage2026-10-17 16:49 UTCby GitHub Advisories–FIX 4.2.1 MEDIUM6.1filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock pathfilelockPackage2026-10-17 16:49 UTCby GitHub Advisories–FIX 4.2.1 MEDIUM4.7ANT-2026-RKC48J5Bfilelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reusefilelockPackage2026-10-17 16:49 UTCby GitHub Advisories–FIX 4.2.1 MEDIUM5.3Seriously Simple Podcasting WordPress plugin: missing authorization check through 3.17.0Package2026-10-20 15:17 UTCby NVD–WHAT TO DO MEDIUM6.5Seriously Simple Podcasting WordPress plugin: stored XSS through version 3.17.0Other2026-10-20 15:17 UTCby NVD–WHAT TO DO MEDIUM5.7A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failureorg.a2aproject.sdk:a2a-java-sdk-transport-restPackage2026-08-28 07:45 UTCby GitHub Advisories–FIX 1.3.0.Final MEDIUM5.8A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification deliveryorg.a2aproject.sdk:a2a-java-sdk-server-commonAI agents & MCP2026-08-28 07:47 UTCby GitHub Advisories–FIX 1.3.0.Final HIGH8.2@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)@angular/routerPackage2026-09-30 19:32 UTCby GitHub Advisories–FIX 22.2.1 MEDIUM5.1@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)@angular/platform-serverPackage2026-09-30 19:29 UTCby GitHub Advisories–FIX 22.2.1 HIGH8.9Crass : Large numeric exponents cause CPU and memory denial of servicecrassPackage2026-06-25 17:11 UTCby GitHub Advisories–FIX 1.0.7 MEDIUM4.9USBX HID host: short report descriptor triggers heap out-of-bounds readRuntime2026-10-02 18:45 UTCby NVD–WHAT TO DO MEDIUM4.9USBX host: oversized VideoStreaming descriptor length lets device read past bufferRuntime2026-10-02 18:45 UTCby NVD–WHAT TO DO LOWNOT SCOREDApache Tomcat: incomplete cleanup makes TLS 1.3 connections fail intermittentlyRuntime2026-10-20 14:17 UTCby NVD–WHAT TO DO HIGH7.8FAT filesystem log replay heap overflow gives instruction pointer controlfilexInfrastructure2026-10-02 18:43 UTCby InfraStack Analyst–FIX 6.5.2.202603 LOWNOT SCOREDApache Tomcat: trailer headers from one request can leak into anotherRuntime2026-10-20 14:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDApache Tomcat: APR/Native connector socket race lets local users access socketRuntime2026-10-20 14:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDApache Tomcat: execution after redirect flaw affects versions up to 11.0.26Runtime2026-10-20 14:17 UTCby NVD–WHAT TO DO LOWNOT SCOREDApache Tomcat: FIPS mode failure silently falls back to non-FIPS cryptoRuntime2026-10-20 14:17 UTCby NVD–WHAT TO DO HIGH7.4DrayTek Vigor2960 router: rename_table flaw allows remote command injectionInfrastructure2026-10-20 14:16 UTCby NVD–WHAT TO DO HIGH7.4DrayTek Vigor2960 router: path traversal in firmware upload via multipartInfrastructure2026-10-20 14:16 UTCby NVD–WHAT TO DO HIGH7.4DrayTek Vigor2960 router: path traversal in setSWMProfile via mainfunction.cgiInfrastructure2026-10-20 14:16 UTCby NVD–WHAT TO DO MEDIUM6.5DrayTek Vigor2960 router: unrestricted file upload via mainfunction.cgiInfrastructure2026-10-20 14:16 UTCby NVD–WHAT TO DO HIGH9.1Apache Tomcat: large non-blocking writes can leak response data across requestsApache TomcatRuntime2026-10-20 14:16 UTCby InfraStack Analyst–FIX 11.0.27 CRITICAL9.1Apache Tomcat: HTTP/2 async servlets can mix up responses between usersRuntime2026-10-20 14:16 UTCby NVD–WHAT TO DO CRITICAL9.1Apache Tomcat: JNDI realm with non-GSSAPI SASL lets attackers skip password checkApache Tomcat 11Runtime2026-10-20 14:16 UTCby InfraStack Analyst–FIX 11.0.27 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in workalender (PyPI)workalenderPackage2026-10-20 13:36 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in pafex (PyPI)pafexPackage2026-10-20 13:23 UTCby osv-malicious–UNINSTALL HIGHNOT SCOREDNokia 1830 GX: low-privileged SSH user reaches the underlying OS shellNokia 1830 Global Express (GX)Infrastructure2026-10-20 13:16 UTCby InfraStack Analyst–FIX GX r9.0 NOT SCOREDNOT SCOREDNokia 1830 GX: local shell escape gives authenticated users root accessInfrastructure2026-10-20 13:16 UTCby NVD–WHAT TO DO CRITICAL9.8Eclipse ioFog Controller: forged token grants admin exec and log accesseclipse-iofog-controllerInfrastructure2026-10-20 13:16 UTCby InfraStack Analyst–FIX 3.9.2 HIGH7.5Eclipse ioFog Controller: unauthenticated request body can stall or crash control planeRuntime2026-10-20 13:16 UTCby NVD–WHAT TO DO MEDIUM5.4Firefox: cryptographic flaw in block-list and allow-list state componentRuntime2026-10-20 13:16 UTCby Vendor & lab pages–WHAT TO DO MEDIUM6.5Firefox and Thunderbird: PDF Viewer flaw lets a file crash the appOther2026-10-20 13:16 UTCby NVD–WHAT TO DO MEDIUM5.4Firefox and Thunderbird: uninitialized memory in cubeb audio codeRuntime2026-10-20 13:16 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDFirefox and Thunderbird: SVG boundary check flaw fixed in 158.0.1Other2026-10-20 13:16 UTCby NVD–WHAT TO DO HIGH7.4DrayTek Vigor2960 router: path traversal in mainfunction.cgi ApmuploadInfrastructure2026-10-20 13:16 UTCby NVD–WHAT TO DO CRITICAL9.9DrayTek Vigor2960 router: remote command injection via firmware upload endpointInfrastructure2026-10-20 13:16 UTCby NVD–WHAT TO DO CRITICAL9.9DrayTek Vigor2960 router: command injection in CGI interface lets remote attackers run commandsVigor2960Infrastructure2026-10-20 13:16 UTCby InfraStack Analyst–WHAT TO DO HIGH8.1Kroxylicious: untrusted vault name leaks Azure bearer token via SSRFkroxylicious-kms-provider-azure-key-vault-kmsPackage2026-10-20 13:16 UTCby InfraStack Analyst–FIX 0.25.1 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in resion (PyPI)resionPackage2026-10-20 13:16 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in workcalender (PyPI)workcalenderPackage2026-10-20 13:05 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in test-workalendar-internal (PyPI)test-workalendar-internalPackage2026-10-20 13:00 UTCby osv-malicious–UNINSTALL MEDIUM6.1Ticimax E-Commerce Platform: reflected XSS lets attackers run scripts in shoppers' browsersVendor2026-10-20 12:17 UTCby NVD–WHAT TO DO HIGH8.6Unblu Spark: co-browsing flaw lets visitors run scripts in agent browsersUnblu SparkVendor2026-10-20 12:17 UTCby InfraStack Analyst–FIX 8.35.2-hotfix.0 MEDIUM6.1Cypht webmail: crafted email image alt text runs script in sessionPackage2026-10-20 12:17 UTCby NVD–WHAT TO DO MEDIUM5.0cockpit-machines: VNC console password visible in process listPackage2026-10-20 12:17 UTCby NVD–WHAT TO DO MEDIUM5.0cockpit-machines: RHSM tokens visible in process arguments to local usersInfrastructure2026-10-20 12:17 UTCby NVD–WHAT TO DO CRITICAL9.9DrayTek Vigor2960 router: command injection via web management CGIVigor2960Infrastructure2026-10-20 12:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.8OSSN: admin cache settings let remote code injection through PHPOther2026-10-20 12:17 UTCby NVD–WHAT TO DO MEDIUM5.3Shortcutter 2 Android app: component export flaw lets local apps reach internalsPackage2026-10-20 12:17 UTCby NVD–WHAT TO DO HIGH8.8Cruise Control: path tricks bypass Jetty auth on all 15 admin endpointscruise-controlPackage2026-10-20 12:17 UTCby InfraStack Analyst–FIX 3.1.0 CRITICAL9.9Strimzi Console: tenant image injection grants cluster-wide Kafka control-plane accessstreamshub/consoleInfrastructure2026-10-20 12:17 UTCby InfraStack Analyst–FIX 0.12.10 HIGH7.7StreamsHub Console operator leaks Kafka user secrets across Kubernetes namespacesstreamshub-consoleInfrastructure2026-10-20 12:17 UTCby InfraStack Analyst–FIX 0.12.10 CRITICAL9.3Unblu Spark: missing authorization lets users read and change other accounts' settingsUnblu SparkVendor2026-10-20 11:17 UTCby InfraStack Analyst–FIX 8.37.2 MEDIUM5.0Optimal IdM OptimalCloud: manipulated state argument enables open redirectVendor2026-10-20 11:17 UTCby NVD–WHAT TO DO MEDIUM5.0Optimal IdM OptimalCloud: login page tz parameter enables cross-site scriptingVendor2026-10-20 11:17 UTCby NVD–WHAT TO DO MEDIUM6.5arizu-id fast-tunnel: plugin installer allows unrestricted file upload remotelyPackage2026-10-20 11:17 UTCby NVD–WHAT TO DO HIGH8.7LavaLite CMS: unauthenticated download of private uploaded filesLavaLite CMSPackage2026-10-20 11:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM5.1@e2e-dev/github: any PR commenter can forge CI test report commentsPackage2026-10-20 11:17 UTCby NVD–WHAT TO DO HIGH7.7DokuWiki: draft handling lets editors run code via PHP object injectionPackage2026-10-20 11:17 UTCby NVD–WHAT TO DO MEDIUM4.8Chatwoot: Help Center video links let admins inject scripts into public pagesPackage2026-10-20 11:17 UTCby NVD–WHAT TO DO HIGH7.1Dockhand: non-admin users can read arbitrary server filesOther2026-10-15 10:26 UTCby NVD–WHAT TO DO MEDIUM5.4LearnPress: instructors can edit other instructors' courses, quizzes and questionsPackage2026-10-20 11:17 UTCby NVD–WHAT TO DO HIGH7.7uTox: path traversal lets Tox friends write arbitrary files and run codePackage2026-10-20 11:17 UTCby NVD–WHAT TO DO HIGH8.2libexpat: parser reset leaks memory accounting, later XML parses failInfrastructure2026-10-20 11:17 UTCby NVD–WHAT TO DO MEDIUM5.4react-admin: stored javascript: URIs in UrlField and FileField enable XSSPackage2026-10-20 11:17 UTCby NVD–WHAT TO DO MEDIUM5.3OpenCATS: authenticated users can edit or delete other users' calendar eventsPackage2026-10-20 11:17 UTCby NVD–WHAT TO DO MEDIUM5.3OpenCATS: authenticated users can view EEO demographic reports without permissionPackage2026-10-20 11:17 UTCby NVD–WHAT TO DO MEDIUM5.4OpenCATS: low-privileged users can roll back imports and delete recordsPackage2026-10-20 11:17 UTCby NVD–WHAT TO DO MEDIUM5.3OpenCATS: read-only users can alter or delete any saved listPackage2026-10-20 11:17 UTCby NVD–WHAT TO DO MEDIUM5.3OpenCATS: any logged-in user can send mail via SMTP relayPackage2026-10-20 11:17 UTCby NVD–WHAT TO DO MEDIUM5.3OpenCATS: read-only users can edit and delete activity recordsPackage2026-10-20 11:17 UTCby NVD–WHAT TO DO HIGH7.5Apache Cocoon: unauthenticated access to diagnostic interfaces exposes debug dataPackage2026-10-20 11:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDApache Cocoon: shared cache can serve one user's content to anotherPackage2026-10-20 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDApache Cocoon: SQL injection via SQL processor and logicsheets, no fixOther2026-10-20 11:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDApache Cocoon: XML entity expansion in form processor enables server-side request forgeryPackage2026-10-20 11:17 UTCby NVD–WHAT TO DO MEDIUM6.9OIDC discovery and JWKS fetches block the asyncio event loopOther2026-10-20 10:04 UTCby NVD–WHAT TO DO MEDIUM5.1PIA: token check fetches attacker-chosen URLs, enabling server-side request forgeryOther2026-10-20 10:06 UTCby NVD–WHAT TO DO MEDIUMINCIDENTTwilio: Voice Call Failures from Twilio Phone Numbers to Digi.Mobil RomaniaTwilioVendor2026-10-20 10:46 UTCby status page–WHAT TO DO HIGH8.7Google Cloud Shell: cross-site WebSocket flaw leaks OAuth tokens from sessionsVendor2026-10-20 10:17 UTCby NVD–WHAT TO DO HIGH8.6Stack buffer overflow lets an authenticated remote user run codeADAM-3600Other2026-10-20 10:17 UTCby InfraStack Analyst–FIX 2.8.5.0 HIGH8.6Authenticated remote attacker can run code with service privilegesADAM-3600Other2026-10-20 10:17 UTCby InfraStack Analyst–FIX 2.8.5.0 HIGH8.6FileProcess::CheckDir stack overflow lets authenticated remote user run codeADAM-3600 EdgeLinkOther2026-10-20 10:17 UTCby InfraStack Analyst–FIX 2.8.5.0 HIGH7.5Heap buffer overflow lets an authenticated remote attacker run codeADAM-3600 EdgeLinkOther2026-10-20 10:17 UTCby InfraStack Analyst–FIX 2.8.5.0 MEDIUM6.3Encrypted project file leaks administrator credentials for EdgeLink-enabled devicesOther2026-10-20 10:17 UTCby NVD–WHAT TO DO HIGH8.2Crafted message triggers assertion fault and crashes the serviceADAM-3600 EdgeLinkOther2026-10-20 10:17 UTCby InfraStack Analyst–FIX 2.8.5.0 HIGH8.2Authenticated attacker can write files to arbitrary system locationsADAM-3600Other2026-10-20 10:17 UTCby InfraStack Analyst–FIX 2.8.5.0 HIGH8.2Authenticated path traversal lets attackers read arbitrary files on systemADAM-3600Other2026-10-20 10:17 UTCby InfraStack Analyst–FIX 2.8.5.0 HIGH8.6Unnamed product: authenticated command injection grants root code executionADAM-3600Other2026-10-20 10:17 UTCby InfraStack Analyst–FIX 2.8.5.0 MEDIUM6.9Heap memory read flaw could let attackers exfiltrate sensitive dataOther2026-10-20 10:17 UTCby NVD–WHAT TO DO MEDIUM6.9PayPal payment notification endpoint accepts unverified data from any visitorVendor2026-10-20 10:17 UTCby NVD–WHAT TO DO HIGH7.1TYPO3: OpenAI API key exposed in every backend page sourceAI agents & MCP2026-10-20 10:17 UTCby NVD–WHAT TO DO MEDIUM5.3HTML email summary includes unescaped visitor input, allowing HTML injectionOther2026-10-20 10:17 UTCby NVD–WHAT TO DO HIGH7.5Osclass: SQL injection in item search lets remote attackers read the databaseosclassPackage2026-10-20 10:17 UTCby InfraStack Analyst–FIX 8.4.0 MEDIUM5.3mcp-ripgrep: fileType argument allows OS command injection on local machineAI agents & MCP2026-10-20 10:17 UTCby NVD–WHAT TO DO MEDIUM6.3Form file download links use guessable tokens, exposing other visitors' uploadsOther2026-10-20 10:17 UTCby NVD–WHAT TO DO HIGH7.2TYPO3 extension lets any backend user edit any page fieldPackage2026-10-20 10:17 UTCby NVD–WHAT TO DO HIGH8.7Browser extension file search lets crafted terms read the databaseameos/ameos_filemanagerOther2026-10-20 10:17 UTCby InfraStack Analyst–FIX 3.1.3 MEDIUM6.9Browser extension proxy endpoint lets anyone make server fetch arbitrary URLsOther2026-10-20 10:17 UTCby NVD–WHAT TO DO MEDIUM6.9Order cancellation flaw lets any visitor cancel unpaid ordersOther2026-10-20 10:17 UTCby NVD–WHAT TO DO MEDIUM5.3TYPO3 extension lets backend users read analytics beyond their module accessOther2026-10-20 10:17 UTCby NVD–WHAT TO DO MEDIUM6.3TYPO3 extension: file storage access protection skipped for non-default base pathsPackage2026-10-20 10:17 UTCby NVD–WHAT TO DO MEDIUM5.3Backend module lets users view analytics for any siteOther2026-10-20 10:17 UTCby NVD–WHAT TO DO MEDIUM6.9CAPTCHA extension leaks its answer inside the image, letting bots passOther2026-10-20 10:17 UTCby NVD–WHAT TO DO HIGH7.1Cookie consent JSON import skips backend permissions, letting users inject scriptssgalinski/sg-cookie-optinOther2026-10-20 10:17 UTCby InfraStack Analyst–FIX 7.4.6 MEDIUM5.3Consent history route lacks permission check, exposing consent dataOther2026-10-20 10:17 UTCby NVD–WHAT TO DO HIGH7.1TYPO3 consent history module: SQL injection leaks user password hashessgalinski/sg-cookie-optinOther2026-10-20 10:17 UTCby InfraStack Analyst–FIX 7.4.6 MEDIUM6.5Brizy page builder: stored XSS via unsanitized input in version 2.8.23Package2026-10-20 10:17 UTCby NVD–WHAT TO DO MEDIUMNOT SCOREDApache Parquet and PyArrow: file-controlled KMS URL can leak tokens to attacker hostPackage2026-10-20 09:17 UTCby NVD–WHAT TO DO MEDIUM6.9Bulk port configuration flaw lets an unauthenticated attacker crash the serviceInfrastructure2026-10-20 09:17 UTCby NVD–WHAT TO DO HIGH8.2Proprietary protocol lets attackers brute force administrator password without limitsADAM-3600Infrastructure2026-10-20 09:17 UTCby InfraStack Analyst–FIX 2.8.5.0 HIGH8.6Stack buffer overflow in a non-functional feature allows code executionADAM-3600Other2026-10-20 09:17 UTCby InfraStack Analyst–FIX 2.8.5.0 CRITICAL9.2Unnamed product: password reset flaw lets attackers bypass loginADAM-3600 EdgeLinkOther2026-10-20 09:17 UTCby InfraStack Analyst–FIX 2.8.5.0 CRITICAL9.3Unnamed proprietary protocol lets attackers bypass authentication entirelyADAM-3600 EdgeLinkOther2026-10-20 09:17 UTCby InfraStack Analyst–FIX 2.8.5.0 MEDIUM6.9License manager service integer overflow lets unauthenticated attackers crash the serviceInfrastructure2026-10-20 09:17 UTCby NVD–WHAT TO DO MEDIUM6.9License manager service crashes when an unauthenticated message has zero lengthOther2026-10-20 09:17 UTCby NVD–WHAT TO DO MEDIUM6.9License manager service crashes via NULL pointer in rpc_rx_fsmOther2026-10-20 09:17 UTCby NVD–WHAT TO DO MEDIUM6.9License manager service crashes via NULL pointer in disconnect callbackOther2026-10-20 09:17 UTCby NVD–WHAT TO DO HIGH8.7Unnamed logs management component: unauthenticated NULL dereference crashes serviceADAM-3600 EdgeLinkOther2026-10-20 09:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.2Unnamed login component: stack overflow lets attacker run codeADAM-3600 EdgeLinkOther2026-10-20 09:17 UTCby InfraStack Analyst–FIX 2.8.5.1 HIGH7.5Password verification buffer overflow lets guest-authenticated attacker run codeADAM-3600 EdgeLinkOther2026-10-20 09:17 UTCby InfraStack Analyst–FIX 2.8.5.0 CRITICAL9.3Forged network packet can run arbitrary commands with maximum privilegesADAM-3600 EdgeLinkOther2026-10-20 09:17 UTCby InfraStack Analyst–FIX 2.8.5.0 MEDIUM6.9FacturaScripts: login responses reveal which usernames existPackage2026-10-20 09:17 UTCby NVD–WHAT TO DO MEDIUM6.9FacturaScripts: stored XSS in warehouse city and province fieldsPackage2026-10-20 09:17 UTCby NVD–WHAT TO DO HIGH7.5SNS: dynamic data signature check accepts unauthenticated updates during autoupdateStormshield Network SecurityInfrastructure2026-10-20 09:17 UTCby InfraStack Analyst–FIX 4.3.45 QS MEDIUM6.6Stormshield web administration panel: DOM-based XSS via crafted URLInfrastructure2026-10-20 09:17 UTCby NVD–WHAT TO DO MEDIUM4.3Qt: malformed binary JSON header causes out-of-bounds readPackage2026-10-20 09:17 UTCby NVD–WHAT TO DO HIGH8.6Firmware upgrade accepts forged images, letting an authenticated user persist on deviceADAM-3600 EdgeLinkInfrastructure2026-10-20 08:16 UTCby InfraStack Analyst–FIX 2.8.5.0 HIGH7.5Stack buffer overflow in logs settings lets authenticated attacker run codeADAM-3600Other2026-10-20 08:16 UTCby InfraStack Analyst–FIX 2.8.5.0 HIGH8.8BA-Workflow: SQL injection lets logged-in users read, change, or delete dataBA-WorkflowOther2026-10-20 08:16 UTCby InfraStack Analyst–FIX 3.6.2.7 HIGH8.8BA-Workflow: SQL injection lets logged-in attackers read, change, delete dataBA-WorkflowOther2026-10-20 08:16 UTCby InfraStack Analyst–FIX 3.6 HIGH8.8BA-Workflow: SQL injection lets logged-in users read, change, delete dataBA-WorkflowOther2026-10-20 08:16 UTCby InfraStack Analyst–FIX 3.6.2.7 HIGH7.3Ghostscript on RHEL 8: crafted PostScript escapes -dSAFER and runs commandsRuntime2026-10-20 08:16 UTCby NVD–WHAT TO DO HIGH7.8Stormshield firewall accepts unsigned update and license filesStormshield Network SecurityInfrastructure2026-10-20 08:16 UTCby InfraStack Analyst–FIX 4.3.45 QS MEDIUM4.8RemoteUserStoreManagerService: password change lets attackers brute-force user passwordsOther2026-10-20 08:16 UTCby NVD–WHAT TO DO MEDIUMINCIDENTMongoDB Atlas: GCP Availability Zone europe-west2-b connectivity issuesMongoDB AtlasVendor2026-10-20 07:32 UTCby status page–WHAT TO DO MEDIUM6.4DiviGear Carousel WordPress plugin: stored XSS via license update actionPackage2026-10-20 07:17 UTCby NVD–WHAT TO DO HIGH8.8WebITR: insecure deserialization lets authenticated users run code on serverWebITROther2026-10-20 07:17 UTCby InfraStack Analyst–FIX 2_1_0_36 HIGH7.1ArmorX Spam: authenticated command injection lets attackers upload malicious codeArmorX SpamInfrastructure2026-10-20 07:17 UTCby InfraStack Analyst–FIX 8.15.2-3.282.133-1.90.061 HIGH7.1ArmorX Spam: local file inclusion lets authenticated users include outside filesArmorX SpamOther2026-10-20 07:17 UTCby InfraStack Analyst–FIX 8.15.2-3.282.133-1.90.061 MEDIUM5.1LIFF SDK: DOM XSS via crafted URL exposes tokens and session actionsPackage2026-10-20 06:31 UTCby NVD–WHAT TO DO LOW3.7fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix referencesfast-uriPackage2026-10-19 23:45 UTCby GitHub Advisories–FIX 2.4.8 MEDIUM6.1fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decodingfast-uriPackage2026-10-19 23:35 UTCby GitHub Advisories–FIX 2.4.8 MEDIUM4.8fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalizationfast-uriPackage2026-10-19 23:36 UTCby GitHub Advisories–FIX 2.4.8 LOW3.7fast-uri vulnerable to improper path equivalence in relative reference normalizationfast-uriPackage2026-10-19 23:35 UTCby GitHub Advisories–FIX 2.4.8 MALICIOUSDON'T INSTALLREMOVE ITMalicious code in @platform-services/hrm-mfe-core (npm)@platform-services/hrm-mfe-corePackage2026-10-20 06:40 UTCby osv-malicious–UNINSTALL HIGH8.6Atsumi Electric DVRs: hidden feature lets an admin run OS commandsADX5004/ADX5008/ADX404/ADX3004/ADX3008/ADX3016/ADX204Infrastructure2026-10-20 06:16 UTCby InfraStack Analyst–FIX 10.8.237 MEDIUM4.3Easy Property Listings WordPress plugin: subscribers can read other users' CRM recordsPackage2026-10-20 06:16 UTCby NVD–WHAT TO DO MEDIUM5.3WordPress Easy Property Listings plugin leaks hidden listing fields via REST APIPackage2026-10-20 06:16 UTCby NVD–WHAT TO DO HIGH7.5EventON Subscriber WordPress plugin: unauthenticated SQL injection via email parameterPackage2026-10-20 06:16 UTCby NVD–WHAT TO DO MEDIUM6.9Atsumi Electric DVRs: admin can flash unauthorized firmware via hidden functionInfrastructure2026-10-20 06:16 UTCby NVD–WHAT TO DO MEDIUMINCIDENTTwilio: Silent Network Authentication (SNA) Failure Increase on AT&T in United StatesTwilioVendor2026-10-20 05:28 UTCby status page–WHAT TO DO HIGH7.1Roundcube Webmail: CRLF in mail uid lets authenticated users run IMAP commandsPackage2026-10-20 05:16 UTCby NVD–WHAT TO DO CRITICAL9.3RingRTC: a peer can block a local hangup from tearing down a callringrtc1 talkingPackage2026-10-20 05:16 UTCby InfraStack Analyst1talkingFIX 2.72.0 MEDIUM5.4UnRTF: out-of-bounds write lets a crafted RTF file crash itPackage2026-10-20 05:16 UTCby NVD–WHAT TO DO MALICIOUSDON'T INSTALLREMOVE ITMalicious code in sc-announcer (npm)sc-announcerPackage2026-10-20 04:11 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in fanarena-common (npm)fanarena-commonPackage2026-10-20 03:55 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in ccl-global-shopping (npm)ccl-global-shoppingPackage2026-10-20 03:43 UTCby osv-malicious–UNINSTALL MALICIOUSDON'T INSTALLREMOVE ITMalicious code in sc-wizard (npm)sc-wizardPackage2026-10-20 03:31 UTCby osv-malicious–UNINSTALL CRITICALINCIDENTCloudflare: Cloudflare Zero Trust connectivityCloudflareVendor2026-10-20 03:20 UTCby status page–WHAT TO DO HIGHNOT SCOREDApache Airflow Amazon provider: SAML login lets attackers hijack victim sessionsPackage2026-10-20 03:17 UTCby NVD–WHAT TO DO MEDIUM6.5Zyxel EX3501-T0 firmware: authenticated users can escalate privileges via login_privilegeInfrastructure2026-10-20 03:17 UTCby NVD–WHAT TO DO MEDIUM5.3ASUS routers: unauthenticated nearby HTTP commands return device info and force a modeInfrastructure2026-10-20 02:17 UTCby NVD–WHAT TO DO HIGH8.2ASUS router firmware: oversized HTTP input corrupts device, denial of serviceInfrastructure2026-10-20 02:17 UTCby NVD–WHAT TO DO HIGH8.7Pingora proxy: client Connection header can strip origin-trusted headersPackage2026-10-20 02:17 UTCby NVD–WHAT TO DO HIGH8.5ASUS Armoury Crate: local DLL search path flaw grants SYSTEM code executionInfrastructure2026-10-20 02:17 UTCby NVD–WHAT TO DO MEDIUMINCIDENTTwilio: Voice Call Failures from Network Subscribers to a Subset of Twilio Thailand Phone NumbersTwilioVendor2026-10-20 02:05 UTCby status page–WHAT TO DO MEDIUM5.5Apple macOS: out-of-bounds write lets an app crash the systemInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM5.5Apple macOS: a privacy check flaw lets an app read sensitive user dataInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDApple iOS and iPadOS: network restriction flaw lets apps place calls or send messagesInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM5.5Apple iOS, iPadOS and macOS: app can access sensitive user dataInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM4.3Apple: crafted image crashes apps on iOS, macOS and other platformsOther2026-10-20 01:17 UTCby Vendor & lab pages–WHAT TO DO MEDIUM5.9Apple iOS and iPadOS: input validation flaw enables network denial-of-serviceInfrastructure2026-10-20 01:17 UTCby Vendor & lab pages–WHAT TO DO MEDIUM5.5Apple iOS and macOS: double free lets an app crash the systemInfrastructure2026-10-20 01:17 UTCby PoC on GitHub–WHAT TO DO HIGH7.8Apple iOS and macOS: race condition lets malicious app escape sandboxInfrastructure2026-10-20 01:17 UTCby Vendor & lab pages–WHAT TO DO LOWNOT SCOREDApple iOS and macOS: crafted image crashes a process via input validationInfrastructure2026-10-20 01:17 UTCby Vendor & lab pages–WHAT TO DO MEDIUM6.5Apple: out-of-bounds read lets nearby attacker crash iOS and macOSInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM5.5Apple iOS and iPadOS: authorization flaw lets an app read sensitive user dataInfrastructure2026-10-20 01:17 UTCby Vendor & lab pages–WHAT TO DO MEDIUM4.6Apple OS: out-of-bounds write lets nearby attacker crash devicesOther2026-10-20 01:17 UTCby NVD–WHAT TO DO HIGH8.8Xcode: malicious app can break out of its sandboxXcodeInfrastructure2026-10-20 01:17 UTCby InfraStack Analyst–FIX 27 NOT SCOREDNOT SCOREDXcode: app can escape its sandbox through unvalidated library loadingInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDApple iOS, macOS: out-of-bounds write can crash the systemInfrastructure2026-10-20 01:17 UTCby Vendor & lab pages–WHAT TO DO MEDIUM5.5Apple macOS: app can disclose kernel memory, fixed in Golden Gate 27Infrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDmacOS: extra app entitlements let an app read user-sensitive dataInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO LOW3.3Apple macOS: sandbox permissions flaw exposed user contact information to appsOther2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM5.5macOS: authorization flaw lets an app access sensitive user dataInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM5.5Apple macOS: path handling flaw lets an app read protected user dataOther2026-10-20 01:17 UTCby NVD–WHAT TO DO HIGH8.8Safari and Apple OS: type confusion lets web content run codeOther2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM6.2Apple iOS and macOS: permissions flaw lets local attacker overwrite restricted filesInfrastructure2026-10-20 01:17 UTCby Vendor & lab pages–WHAT TO DO HIGH8.8Apple iOS and macOS: stack overflow via paired Bluetooth device runs codeInfrastructure2026-10-20 01:17 UTCby Vendor & lab pages–WHAT TO DO MEDIUM4.3Apple OS: crafted image crashes apps through an out-of-bounds writeVendor2026-10-20 01:17 UTCby Vendor & lab pages–WHAT TO DO MEDIUM4.7macOS: race condition lets an app crash the whole systemInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM5.5Apple macOS: app can read sensitive network connection informationInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM5.4Apple OS: crafted media file can crash apps or corrupt memoryInfrastructure2026-10-20 01:17 UTCby Vendor & lab pages–WHAT TO DO MEDIUM4.4macOS: an admin-privileged app can modify the System KeychainInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM4.3Xcode: malformed binary parsing crashes apps, fixed in Xcode 27Other2026-10-20 01:17 UTCby NVD–WHAT TO DO LOW3.3Xcode: crafted binary parsing out-of-bounds read crashes the toolRuntime2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM5.4Safari and visionOS: crafted web content causes unexpected behaviorOther2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM5.9macOS: integer underflow lets a network file server crash the systemInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDmacOS: authentication state flaw lets an attacker impersonate other usersInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM6.5Apple iOS and macOS: out-of-bounds write lets a nearby attacker crash the systemInfrastructure2026-10-20 01:17 UTCby Vendor & lab pages–WHAT TO DO NOT SCOREDNOT SCOREDApple iOS and macOS: improved access restrictions fix an app data-access flawOther2026-10-20 01:17 UTCby Vendor & lab pages–WHAT TO DO NOT SCOREDNOT SCOREDApple macOS: opening a network-share file may run unexpected softwareInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO LOW3.5macOS: memory corruption in input handling lets nearby attacker corrupt process memoryInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM5.5Apple iOS and macOS: missing access check lets an app read protected user dataOther2026-10-20 01:17 UTCby NVD–WHAT TO DO LOW2.0Apple iOS and iPadOS: locked device lets attacker bypass Digital ID authenticationInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO HIGH7.1Letta: tool sandbox leaks server secrets and database credentials to usersAI agents & MCP2026-10-20 01:17 UTCby NVD–WHAT TO DO HIGH8.6Letta: user_id header lets API callers impersonate other tenantslettaAI agents & MCP2026-10-20 01:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8Letta: shipped compose file leaves API and database unauthenticatedAI agents & MCP2026-10-20 01:17 UTCby NVD–WHAT TO DO HIGH8.7Coze Studio: authenticated users read and alter other tenants' workflowscoze-studioAI agents & MCP2026-10-20 01:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8Coze Studio: any registered user runs commands via workflow code nodescoze-studioAI agents & MCP2026-10-20 01:17 UTCby InfraStack Analyst–FIX 0.5.0 CRITICAL9.8DB-GPT: hardcoded MySQL root password lets attackers take full database accessAI agents & MCP2026-10-20 01:17 UTCby NVD–WHAT TO DO CRITICAL9.8DB-GPT: unauthenticated endpoint lets any caller run code as rootDB-GPTAI agents & MCP2026-10-20 01:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8EvoScientist: approval bypass lets web content run host shell commandsEvoScientistAI agents & MCP2026-10-20 01:17 UTCby InfraStack Analyst–FIX 0.2.5 HIGH8.8Aix-DB: authenticated users can run OS commands via ChatBI agentAix-DBAI agents & MCP2026-10-20 01:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8Langchain-Chatchat: unauthenticated API lets anyone run OS commandslangchain-chatchat1 talkingAI agents & MCP2026-10-20 01:17 UTCby InfraStack Analyst1talkingWHAT TO DO MEDIUM5.5Apple macOS: buffer overflow lets an app crash the systemInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM5.5macOS: secure input handling flaw lets an app read sensitive user dataInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM4.7macOS: race condition lets an app bypass Privacy preferencesOther2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM5.5Apple macOS: an app can read sensitive user data via access flawInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDApple macOS: app bundle integrity checks missing, modified apps may launchInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO HIGH7.8macOS: a local app can gain elevated privileges through a missing checkInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO MEDIUM5.5visionOS: authorization flaw lets an app reach sensitive user dataInfrastructure2026-10-20 01:17 UTCby NVD–WHAT TO DO CRITICAL9.8OpenSRE: approval gate bypass lets injected alerts run host shell commandsopensreAI agents & MCP2026-10-20 01:17 UTCby InfraStack Analyst–WHAT TO DO HIGH8.8JoySafeter: authenticated users run OS commands through Copilot agentJoySafeterAI agents & MCP2026-10-20 01:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.8piflow DeepAgents chat: unauthenticated endpoints run shell commands, expose secretspiflowAI agents & MCP2026-10-20 01:17 UTCby InfraStack Analyst–WHAT TO DO MEDIUM6.9LangAlpha: shared Docker bridge lets tenants reach each other's sandboxesAI agents & MCP2026-10-20 01:17 UTCby NVD–WHAT TO DO HIGH8.8LangAlpha: web-planted prompt injection runs shell commands and steals secretsLangAlphaAI agents & MCP2026-10-20 01:17 UTCby InfraStack Analyst–WHAT TO DO CRITICAL9.1Java compress-lzf: crafted LZF input leaks JVM heap memory or crashescom.ning:compress-lzfPackage2026-10-20 01:17 UTCby InfraStack Analyst–FIX 1.2.0 MEDIUM6.3Pingora: HTTP/2 Host mismatch lets requests reach the wrong virtual hostPackage2026-10-20 01:17 UTCby NVD–WHAT TO DO HIGH7.5Pingora: HTTP/2 server lacks header and stream limits, enabling memory exhaustionPackage2026-10-20 01:17 UTCby NVD–WHAT TO DO NOT SCOREDNOT SCOREDPinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-coregithub.com/xtls/xray-corePackage2026-10-20 00:20 UTCby Go vuln DB–FIX 1.260327.1-0.20260710210335-64fada32b5b9 MEDIUM5.4IBM ContextForge MCP Gateway: OAuth token URL allows server-side request forgeryAI agents & MCP2026-10-20 00:19 UTCby NVD–WHAT TO DO MEDIUM6.8H3C Magic NX15 router: remote stack buffer overflow in usrlistInfrastructure2026-10-20 00:17 UTCby NVD–WHAT TO DO HIGH8.8IBM Verify Access appliance: hard-coded credentials give local attacker elevated privilegesIBM Verify Identity AccessInfrastructure2026-10-20 00:17 UTCby InfraStack Analyst–FIX 11.0.3.2 HIGH8.8IBM TRIRIGA: authenticated user can execute arbitrary code remotelyIBM TRIRIGA Application PlatformOther2026-10-20 00:17 UTCby InfraStack Analyst–FIX 5.0.9 HIGH8.3Langflow: message endpoints let any logged-in user alter others' messagesAI agents & MCP2026-10-20 00:17 UTCby NVD–WHAT TO DO HIGH8.4IBM Sterling Connect Direct for Unix: local users can gain elevated privilegesInfrastructure2026-10-20 00:17 UTCby NVD–WHAT TO DO CRITICAL9.9Kiro Crew: WhatsApp group members can run commands on the hostkirocrew1 talkingAI agents & MCP2026-10-20by InfraStack Analyst1talkingFIX 0.7.2 HIGH8.8AWS CICD toolchain for serverless: IAM policy lets repo writers escalate in accountCICD-toolchain-for-serverless-applicationsInfrastructure2026-10-20by InfraStack Analyst–FIX 1.0.11 HIGHNOT SCOREDCVE-2026-112407 - Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applicationsVendor2026-10-20by Vendor & lab pages–WHAT TO DO NOT SCOREDNOT SCOREDCVE-2026-112380 - Missing authorization in the WhatsApp channel in Kiro CrewAI agents & MCP2026-10-20by Vendor & lab pages–WHAT TO DO

Monday, Oct 19Tuesday, Oct 20Wednesday, Oct 21