Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component:...
CVE-2026-62468
Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite (component: Enterprise Command Center).
#advisory
共收录 23779 条相关情报。
← 返回所有主题Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite ...
CVE-2026-62478
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations)
Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component:...
CVE-2026-62483
Vulnerability in the Oracle Project Contracts product of Oracle E-Business Suite (component: Internal Operations). Supp
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite ...
CVE-2026-62479
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations)
Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite ...
CVE-2026-62474
Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite (component: Lease Authoring)
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite ...
CVE-2026-62480
Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations)
jsforce SFDX Connection Registry sfdx.js _execCommand os command injection
CVE-2026-16489
A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function _execCommand in the library lib
QUSETIONS MiniCode-Python Project File config.py subprocess.Popen os command injection
CVE-2026-16488
A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Po
Netty: Missing CertificateID Validation in OCSP Response Allows Replay Attacks
CVE-2026-56820
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final throug
Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)
CVE-2026-56819
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final throug
fast-uri vulnerable to host confusion via literal backslash authority delimiter
CVE-2026-16221
### Impact `fast-uri` v4.1.0 and earlier do not treat a literal backslash (U+005C) as an authority delimiter. Node's na
sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591
### Impact A number of vulnerabilities, two rated as "High" severity using CVSSv4, have been discovered and fixed in th
Netty: XML External Entity (XXE) injection via unconfigured XML factory when DTD and entity processing are enabled
CVE-2026-56817
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final throug
fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits
### Impact `fast-xml-parser` processes multiple "DOCTYPE" declarations within a single XML document. Each declaration pa
GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL
### Summary `Repo.clone_from()` passes the caller-supplied remote URL through `Git.polish_url()`, which on every non-Cyg
Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations
## Summary There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configu
Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake
## Summary A WebSocket upgrade request to an `upgradeWebSocket` route with a missing or malformed `Sec-WebSocket-Key` h
gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities
Multiple security vulnerabilities have been identified and addressed in grpc-go affecting the xDS RBAC authorization eng
Loofah `allowed_uri?` does not detect `javascript:` URIs split by numeric character references without semicolons
## Summary `Loofah::HTML5::Scrub.allowed_uri?` does not correctly reject `javascript:` or `vbscript:` URIs when the sch
Loofah: SVG `href` attribute bypasses local-reference restriction
## Summary Loofah's HTML5 sanitizer restricted only the `xlink:href` attribute on certain SVG elements to local, same-d