News
-
NVD CVE API 2.0
CVE-2026-115384 · CVSS 9.4
Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-115384 -
NVD CVE API 2.0
CVE-2026-115377 · CVSS 9.4
Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-115377 -
NVD CVE API 2.0
CVE-2026-115375 · CVSS 9.4
Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instance backup with ../ sequences in dependent volume names to create root-owned directories with controlled content, leading to full host compromise.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-115375 -
NVD CVE API 2.0
CVE-2026-115372 · CVSS 9.0
Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject arguments into mkfs executed as root.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-115372 -
NVD CVE API 2.0
CVE-2026-115353 · CVSS 9.2
Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-115353 -
NVD CVE API 2.0
CVE-2026-114612 · CVSS 9.9
LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versio
Fix: 1 public exploit Fix panel
detailsCVE-2026-114612 -
NVD CVE API 2.0
CVE-2022-51026 · CVSS 9.3
Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST endpoint. Attackers can set instanceUrl to a server they control that returns an active user with a chosen email. Bytebase then issues session tokens for that principal, letting attackers impersonate existing users including the Owner or create new members.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2022-51026 -
NVD CVE API 2.0
CVE-2026-114611 · CVSS 9.1
OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint `frontend/api-mdm.php` verifies the signed enrollment-request plist with `openssl_pkcs7_verify(..., PKCS7_NOVERIFY, ...)`. `PKCS7_NOVERIFY` disables signer certificate chain and trust validation, so the signature only has to be self-consistent with whatever certificate is embedded in the PKCS#7 blob. A self-signed certificate from an unrelated attacker is accepted. Because the endpoint trusts the `SERIAL` field t
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-114611 -
NVD CVE API 2.0
CVE-2026-97631 · CVSS 9.5
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-97631 -
NVD CVE API 2.0
CVE-2026-114607 · CVSS 9.1
Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to st
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-114607 -
NVD CVE API 2.0
CVE-2026-102785 · CVSS 10.0
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.
Fix: 4 public exploits Fix panel
detailsCVE-2026-102785 -
NVD CVE API 2.0
CVE-2026-115324 · CVSS 9.2
mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-115324 -
NVD CVE API 2.0
CVE-2026-112832 · CVSS 9.8
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox rootblox allows PHP Local File Inclusion.This issue affects Rootblox: from n/a through 1.0.6.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-112832 -
NVD CVE API 2.0
CVE-2021-48016 · CVSS 9.3
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2021-48016 -
NVD CVE API 2.0
CVE-2021-48014 · CVSS 9.3
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2021-48014 -
NVD CVE API 2.0
CVE-2026-112241 · CVSS 9.8
Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This issue affects SureCart: from n/a through 4.9.5.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-112241 -
NVD CVE API 2.0
CVE-2026-114575 · CVSS 9.3
A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-114575 -
NVD CVE API 2.0
CVE-2026-110264 · CVSS 10.0
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.
Fix: 12 public exploits · Microsoft: Release Notes (azl3 ruby 3.3.5-10 on Azure Linux 3.0) · 1 patch or advisory reference on NVD Fix panel
detailsCVE-2026-110264 -
NVD CVE API 2.0
CVE-2026-96639 · CVSS 9.8
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow frame mode while a later frame of the same dimensions changes the logical mode and decoder tiles to wider RGB or CMYK data. ImageFile.load_prepare() reuses the stale native storage because _im is non-null without verifying that its mode and size still match. Crafted PSD, MPO, DCX, or MIC frame transitions can then write wider pixels into the narrow allocation, causing native out-of-bounds writes and crashes. The MPO path can also cause a native over-read a
Fix: 2 patch or advisory references on NVD Fix panel
detailsCVE-2026-96639 -
NVD CVE API 2.0
CVE-2026-112408 · CVSS 9.4
Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation. To remediate this issue, users should upgrade to Amazon SageMaker Python SDK 3.10.0 (V3) or 2.257.3 (V2).
Fix: vendor advisory: AWS Security Bulletins Fix panel
detailsCVE-2026-112408 -
NVD CVE API 2.0
CVE-2026-111811 · CVSS 9.4
Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-111811 -
NVD CVE API 2.0
CVE-2026-76475 · CVSS 9.3
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilit
Fix: 1 public exploit Fix panel
detailsCVE-2026-76475 -
NVD CVE API 2.0
CVE-2026-76474 · CVSS 9.8
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilit
Fix: 1 public exploit Fix panel
detailsCVE-2026-76474 -
NVD CVE API 2.0
CVE-2026-76473 · CVSS 9.8
As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilit
Fix: 1 public exploit Fix panel
detailsCVE-2026-76473 -
NVD CVE API 2.0
CVE-2026-76466 · CVSS 9.8
A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as root. This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invo
Fix: 1 public exploit Fix panel
detailsCVE-2026-76466 -
NVD CVE API 2.0
CVE-2026-20043 · CVSS 9.0
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20043 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.
Fix: vendor advisory: Cisco Security Advisories Fix panel
detailsCVE-2026-20043 -
NVD CVE API 2.0
CVE-2026-113788 · CVSS 9.4
Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core that would allow an attacker to execute arbitrary code which could lead to, among other things, elevated administrative permissions. It is mitigated by the fact that an attacker must have a Lagoon user account. Exploitation may be detected by checking the container logs of the `ssh` service for: `too many arguments`. The vulnerability was fixed in Lagoon v2.33.2, which is included in the `lagoon/lagoon-core` helm chart v1.62.2. As a workaround, the `ssh`
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-113788 -
NVD CVE API 2.0
CVE-2026-106931 · e-guardian, siteguard · CVSS 8.5
Analyzed; +24 CPE criteria (now 24). SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
Fix: CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securi… (due 2026-10-23) · 1 patch or advisory reference on NVD Fix panel
-
NVD CVE API 2.0
CVE-2026-110936 · siemens, software_center · CVSS 8.4
Analyzed; +1 CPE criteria (now 1). A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search path. This could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
Fix: 1 public exploit · CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securi… (due 2026-11-03) · 2 patch or advisory references on NVD Fix panel
-
NVD CVE API 2.0
CVE-2026-96652 · plex, media_server · CVSS 5.3
Analyzed. Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.
Fix: 7 public exploits · CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securi… (due 2026-11-03) Fix panel
-
NVD CVE API 2.0
CVE-2026-96654 · plex, media_server · CVSS 6.9
Analyzed. Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.
Fix: CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securi… (due 2026-10-23) Fix panel
-
NVD CVE API 2.0
CVE-2026-96655 · plex, media_server · CVSS 5.3
Analyzed. Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.
Fix: CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securi… (due 2026-11-03) Fix panel
-
NVD CVE API 2.0
CVE-2026-96656 · plex, media_server · CVSS 8.6
Analyzed. Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.
Fix: 1 public exploit · CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Securi… (due 2026-10-23) Fix panel
-
NVD CVE API 2.0
CVE-2026-87095 · CVSS 9.1
Sensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Infrastructure (ACI) before build 6.0.1-112, Acronis Cyber Infrastructure (ACI) before build 6.1.1-64, Acronis Cyber Infrastructure (ACI) before build 6.2.1-71.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-87095 -
NVD CVE API 2.0
CVE-2026-71195 · CVSS 9.9
In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual owner. This affects the following operations: allow_access: grant data-plane read/write access to another tenant's share; deny_access: revoke the owner's existing access rules; update_access: escalate access level (e.g., ro to rw); create_share_backup: exfiltrate share data via a backup created under the
Fix: 1 public exploit Fix panel
detailsCVE-2026-71195 -
NVD CVE API 2.0
CVE-2026-113744 · CVSS 9.3
A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipulation of the argument firewallEn leads to stack-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed publicly and may be used.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-113744 -
NVD CVE API 2.0
CVE-2026-114119 · CVSS 9.3
Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-114119 -
NVD CVE API 2.0
CVE-2026-114108 · CVSS 9.3
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /sessions/{id}/messages to trigger root shell commands via BashTool, upload .py or .sh files via /upload, read session histories, and obtain partial API keys.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-114108 -
NVD CVE API 2.0
CVE-2026-114087 · CVSS 9.2
Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authentication bypass because the hardcoded MAGIC_LINK_SECRET lets anyone forge valid magic link tokens. Unauthenticated attackers can log in as any email address, then reach Postgres, Redis, and ClickHouse with default credentials from runner containers on infrastructure networks, compromising all tenant data.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-114087 -
NVD CVE API 2.0
CVE-2026-114053 · CVSS 9.2
vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained, letting clients select which revision of a model's dynamic processor code is imported when trust_remote_code is enabled. An attacker controlling a revision in the served model repository can send a multimodal request to the unauthenticated /tokenize endpoint to execute arbitrary Python in the vLLM API process.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-114053 -
NVD CVE API 2.0
CVE-2026-92559 · CVSS 9.8
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-92559 -
NVD CVE API 2.0
CVE-2026-91665 · CVSS 9.8
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Fix: 1 patch or advisory reference on NVD Fix panel
detailsCVE-2026-91665 -
NVD CVE API 2.0
CVE-2026-91663 · CVSS 9.9
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Fix: 1 patch or advisory reference on NVD Fix panel
detailsCVE-2026-91663 -
NVD CVE API 2.0
CVE-2026-91658 · CVSS 9.9
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Fix: 1 patch or advisory reference on NVD Fix panel
detailsCVE-2026-91658 -
NVD CVE API 2.0
CVE-2026-91656 · CVSS 9.1
Vulnerability in Oracle Essbase (component: Federated Partitions). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible
Fix: 1 patch or advisory reference on NVD Fix panel
detailsCVE-2026-91656 -
NVD CVE API 2.0
CVE-2026-91655 · CVSS 9.1
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data and un
Fix: 1 patch or advisory reference on NVD Fix panel
detailsCVE-2026-91655 -
NVD CVE API 2.0
CVE-2026-91644 · CVSS 9.3
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Essbase accessible data as well as unauthorized update, insert or delete access to some of Oracle Essbase accessible data. CVSS
Fix: 1 patch or advisory reference on NVD Fix panel
detailsCVE-2026-91644 -
NVD CVE API 2.0
CVE-2026-91638 · CVSS 9.9
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Fix: 1 patch or advisory reference on NVD Fix panel
detailsCVE-2026-91638 -
NVD CVE API 2.0
CVE-2026-91637 · CVSS 9.9
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
Fix: 1 patch or advisory reference on NVD Fix panel
detailsCVE-2026-91637 -
NVD CVE API 2.0
CVE-2026-91624 · CVSS 9.1
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Management). The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile Product Lifecycle Management for Process. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Agile Product Lifecycle Management for Process accessible data as well as unauthorized access to cri
Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel
detailsCVE-2026-91624