Tagged “cve.org”
CVEs tagged cve.org, newest first.
47884 CVEsRSS
CVE-2026-91650Low· 3.7Vulnerability in Oracle Essbase (component: Java Based Agent)
Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle E…
CVE-2026-91649Medium· 6.0Vulnerability in Oracle Essbase (component: Java Based Agent)
Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Essbase…
CVE-2026-91652Medium· 5.0Vulnerability in Oracle Essbase (component: Security)
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Wh…
CVE-2026-91651High· 8.5Vulnerability in Oracle Essbase (component: Essbase Web Platform)
Vulnerability in Oracle Essbase (component: Essbase Web Platform). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl…
CVE-2026-91658Critical· 9.9Vulnerability in Oracle Essbase (component: Security)
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Wh…
CVE-2026-91657Medium· 4.3Vulnerability in Oracle Essbase (component: Security)
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Su…
CVE-2026-91654Medium· 6.3Vulnerability in Oracle Essbase (component: Security)
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Su…
CVE-2026-91660Medium· 4.3Vulnerability in Oracle Essbase (component: Security)
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Su…
CVE-2026-91659High· 7.7Vulnerability in Oracle Essbase (component: Build)
Vulnerability in Oracle Essbase (component: Build). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While…
CVE-2026-91662Medium· 6.4Vulnerability in Oracle Essbase (component: Java Based Agent)
Vulnerability in Oracle Essbase (component: Java Based Agent). The supported version that is affected is 21.8.3.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Essbas…
CVE-2026-91664High· 7.5Vulnerability in Oracle Essbase (component: Security)
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Su…
CVE-2026-91663Critical· 9.9Vulnerability in Oracle Essbase (component: Security)
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle Essbase.…
CVE-2026-91661High· 7.7Vulnerability in Oracle Essbase (component: Security)
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Wh…
CVE-2026-91668High· 8.8Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository)
Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privile…
CVE-2026-91665Critical· 9.8Vulnerability in Oracle Essbase (component: Security)
Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Su…
CVE-2026-85783High· 7.5Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key
Crypt::Age versions before 0.004 for Perl allow CPU exhaustion via an unbounded number of recipient stanzas, each costing an X25519 scalar multiplication in unwrap_file_key. The header parser accepts any number of recipient stanzas, and…
CVE-2026-113731Low· 3.3PoCdjust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the find_handlers_for_template MCP tool in python/djust/mcp/server.py acc…
CVE-2025-60475Medium· 5.5PoCA buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
CVE-2026-94402Medium· 6.1IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation
IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write w…
CVE-2026-93888High· 7.8IBM Sterling Connect:Direct for Unix Buffer Overflow
IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.
CVE-2026-82891High· 8.1IBM Guardium Data Protection is affected by a security vulnerability
IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.
CVE-2026-93744Medium· 6.5IBM i Improper Authentication
IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to improper access control. By sending a specially crafted HTTP request to any URL within the Navigator application prior to a…
CVE-2026-93442High· 8.2IBM QRadar SIEM Out-of-bounds Read
IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote attacker to cause a denial of service or obtain sensitive information due to an out-of-bounds read.
CVE-2026-93441High· 8.6IBM QRadar SIEM HTTP Receiver protocol is vulnerable to a denial of service
IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.
CVE-2026-9825Low· 3.7IBM Cyber Fraud Reachable Assertion
IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.
CVE-2026-87800Medium· 6.8IBM Cyber Fraud includes components with multiple known vulnerabilities
IBM Cyber Fraud 1.0.0 through 1.0.2 could allow a remote authenticated attacker to execute arbitrary code due to unrestricted upload of a file with a dangerous type.
CVE-2026-92559Critical· 9.8IBM App Connect Enterprise is vulnerable to a credential exposure
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.
CVE-2026-113704High· 7.3a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery
A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argu…
CVE-2026-81212Critical· 10.0DataStage on Cloud Pak for Data Improper Authorization
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller …
CVE-2026-76587High· 8.8IBM Planning Analytics Buffer Overflow
IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.