2026

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported

Vulnerability in the Identity Manager Connector product of Oracle Fusion Middleware (component: Mainframe Connectors).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). The supp

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Performance Monitor).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supporte

Vulnerability in the Identity Manager product of Oracle Fusion Middleware (component: Core). Supported versions that ar

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are

The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting a

In WC-Radio, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execu

Perry before 0.5.1166 contains a JWT validation vulnerability that allows remote attackers to bypass token expiration by

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thund

Same-origin policy bypass in the Networking: Cookies component. This vulnerability was fixed in Firefox 152, Firefox ESR

Sandbox escape due to incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox

Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 1

Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefo

Sandbox escape in the DOM: Workers component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox E

Use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Kids Online Store allows Upload a Web Sh

Unauthenticated SQL Injection in GEO my WordPress <= 4.5.5 versions.

Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inc

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / Stell

Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.

Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DS

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno

Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missi

Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the l

Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was genera

Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja For

Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.

Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.

Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.

Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websit

Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.

Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.

Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.

Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.

Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <=

Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.

Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.

Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, N