2026 CVEs (page 87)
Page 87 of 663 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-73962 | Critical | 9.6 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73961 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14… |
CVE-2026-73960 | High | 7.5 | 2026-09-15 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Ren Server). Supported versions that are affected are 8.61-8.6… |
CVE-2026-73959 | High | 8.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2026-73958 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73957 | Critical | 9.3 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2… |
CVE-2026-73956 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2026-73955 | High | 7.3 | 2026-09-15 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Charting). Supported versions that are affected are 8.61-8.63… |
CVE-2026-73954 | High | 8.1 | 2026-09-15 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are… |
CVE-2026-73953 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2… |
CVE-2026-73952 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2… |
CVE-2026-73951 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2… |
CVE-2026-73950 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73949 | High | 8.8 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2… |
CVE-2026-73948 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 an… |
CVE-2026-73947 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73946 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73945 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73944 | Critical | 9.1 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73943 | High | 7.6 | 2026-09-15 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4… |
CVE-2026-73942 | High | 8.8 | 2026-09-15 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI). Supported versions that are affected are 12.2.1.4… |
CVE-2026-73941 | High | 8.6 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73940 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73926 | High | 8.7 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-73458 | High | 8.2 | 2026-09-15 | On affected platforms running Arista EOS with authenticated Bidirectional Forwarding Detection (BFD) sessions configured, a specially crafted packet can cause… |
CVE-2026-71163 | Critical | 9.9 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-71133 | Critical | 10.0 | 2026-09-15 | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that are affected are 12… |
CVE-2026-71047 | High | 8.8 | 2026-09-15 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 1… |
CVE-2026-70915 | High | 8.8 | 2026-09-15 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 1… |
CVE-2026-70913 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 1… |
CVE-2026-70757 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2026-70756 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2026-70755 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File download). Supported versions that are aff… |
CVE-2026-70748 | Critical | 9.8 | 2026-09-15 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0, 14.1.1… |
CVE-2026-69218 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, When Ember receives an HTTP/2 HEADERS or PUSH_PROMISE frame without END_HEADERS… |
CVE-2026-69217 | High | 8.7 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts differing duplicate Content-Length headers and u… |
CVE-2026-69215 | Medium | 6.8 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring checks instead of RFC… |
CVE-2026-69210 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload lengths above Inte… |
CVE-2026-69206 | Medium | 5.9 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead of the highest nonc… |
CVE-2026-69205 | High | 8.7 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensitive substring test for the Transfer-Enco… |
CVE-2026-69203 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does not enforce SETTINGS_… |
CVE-2026-69202 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/2 flow-control window is replenished according to bytes received fr… |
CVE-2026-62597 | Medium | 6.5 | 2026-09-15 | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported versions that are a… |
CVE-2026-61544 | | 2026-09-15 | libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.13.1, libp2p-quic could panic during an inbound QUIC handsh… | |
CVE-2026-51134 | High | 7.5 | 2026-09-15 | The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml. |
CVE-2026-51133 | Medium | 6.1 | 2026-09-15 | Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary code via the size para… |
CVE-2026-32599 | | 2026-09-15 | Netmaker makes networks with WireGuard. Prior to version 1.5.0, the `sqliteDeleteRecord` function in Netmaker's database layer constructs SQL `DELETE` statemen… | |
CVE-2026-18425 | Low | 2.7 | 2026-09-15 | Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global access_… |
CVE-2026-18424 | High | 7.1 | 2026-09-15 | Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple… |
CVE-2026-18423 | High | 7.1 | 2026-09-15 | Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure direct object reference (IDOR) in the Express saved search preset delete and edit dialogs . An auth… |
CVE-2026-18422 | Medium | 6.5 | 2026-09-15 | Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend… |
CVE-2026-13327 | High | 8.3 | 2026-09-15 | Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to in… |
CVE-2026-92180 | High | 7.8 | 2026-09-15 | pdfforge PDF Architect activation-service Update Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows l… |
CVE-2026-92179 | High | 7.8 | 2026-09-15 | pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2026-92178 | High | 7.8 | 2026-09-15 | pdfforge PDF Architect PDF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2026-92177 | High | 7.8 | 2026-09-15 | pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2026-92176 | High | 7.8 | 2026-09-15 | pdfforge PDF Architect App Object Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2026-90971 | Medium | 6.5 | 2026-09-15 | Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user… |
CVE-2026-90969 | Medium | 6.5 | 2026-09-15 | Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password p… |
CVE-2026-84850 | Medium | 4.8 | 2026-09-15 | Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a… |
CVE-2026-84048 | | 2026-09-15 | Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitra… | |
CVE-2026-82191 | | 2026-09-15 | Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted… | |
CVE-2026-82190 | | 2026-09-15 | Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's… | |
CVE-2026-82189 | | 2026-09-15 | Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-serv… | |
CVE-2026-81924 | Medium | 6.5 | 2026-09-15 | Concrete CMS before 9.5.3 is vulnerable to Cross-Site Request Forgery (CSRF) in the theme page-template activation feature. The Dashboard theme Inspect control… |
CVE-2026-81923 | Low | 2.7 | 2026-09-15 | In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the… |
CVE-2026-81922 | Low | 2.7 | 2026-09-15 | Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, t… |
CVE-2026-81921 | Medium | 5.4 | 2026-09-15 | Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a va… |
CVE-2026-81920 | Medium | 4.3 | 2026-09-15 | Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset() controller action cleared the admin… |
CVE-2026-81919 | Medium | 4.3 | 2026-09-15 | Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of Concrete\Controller\Backend\Pag… |
CVE-2026-81568 | | 2026-09-15 | Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - `J2StoreModelOrderdownloads::ge… | |
CVE-2026-81567 | | 2026-09-15 | Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unau… | |
CVE-2026-79411 | High | 8.8 | 2026-09-15 | Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.us… |
CVE-2026-79410 | High | 8.1 | 2026-09-15 | Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below… |
CVE-2026-79409 | Medium | 6.5 | 2026-09-15 | An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components. |
CVE-2026-78081 | | 2026-09-15 | Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A f… | |
CVE-2026-73467 | Medium | 6.3 | 2026-09-15 | On affected platforms running Arista EOS, under certain circumstances plaintext shared secrets for configured Terminal Access Controller Access-Control System… |
CVE-2026-73466 | Medium | 6.3 | 2026-09-15 | On affected platforms running Arista EOS, under certain circumstances user passwordss may be written in clear text to log files during operations when speciali… |
CVE-2026-73465 | Medium | 6.3 | 2026-09-15 | On affected platforms running Arista EOS, under certain circumstances plaintext private keys may be written in clear text to log files during operations when s… |
CVE-2026-73451 | Medium | 4.8 | 2026-09-15 | On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode… |
CVE-2026-69216 | Medium | 5.4 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s chunk decoder trims the chunk-size token and accepts leading plus or min… |
CVE-2026-69214 | Medium | 6.8 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute with… |
CVE-2026-69213 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames through one unbounded queue consumed by… |
CVE-2026-69212 | Medium | 5.9 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The FollowRedirect client middleware strips Authorization and Cookie headers onl… |
CVE-2026-69211 | Medium | 4.8 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, content, domain, path, an… |
CVE-2026-69209 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The shared WebSocket decoder permits unbounded message buffering because defragm… |
CVE-2026-69208 | High | 7.5 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the DigestAuth server middleware removes fresh nonces and stops eviction at the… |
CVE-2026-69204 | | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Transfer-Encoding and Co… | |
CVE-2026-69201 | Medium | 5.9 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResourceService and WebjarService decode each URL path segment but reject only s… |
CVE-2026-68534 | | 2026-09-15 | Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scripting. An unauthenti… | |
CVE-2026-68533 | | 2026-09-15 | Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permiss… | |
CVE-2026-68532 | | 2026-09-15 | Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request forgery. A remote una… | |
CVE-2026-68531 | | 2026-09-15 | Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders, and page list, al… | |
CVE-2026-68530 | | 2026-09-15 | Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details… | |
CVE-2026-68529 | | 2026-09-15 | Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advanced_search() method in Da… | |
CVE-2026-58773 | Medium | 6.7 | 2026-09-15 | In link_load_gnss_image of link_device.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privile… |
CVE-2026-58767 | Medium | 6.7 | 2026-09-15 | In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of pr… |
CVE-2026-58766 | High | 7.8 | 2026-09-15 | In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of pr… |
CVE-2026-58765 | Medium | 6.7 | 2026-09-15 | In GPU, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileg… |
CVE-2026-58755 | Medium | 6.7 | 2026-09-15 | In smmu_install_nested_ste of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation… |