Search: 16.5-2

CVE-2026-87311 is a vulnerability in Oracle VM VirtualBox version 7.2.16 that allows a low privileged attacker with logon access to cause a denial of service (DoS) by triggering a hang or repeated crash. The vulnerability is difficult to exploit and impacts availability without compromising confidentiality or integrity. The vulnerability has a CVSS 3.1 base score of 5.6 and affects only version 7.2.16 of Oracle VM VirtualBox.

CVE-2026-87303 is a vulnerability in Oracle VM VirtualBox version 7.2.16 that allows a low privileged attacker with logon access to cause a denial of service. Exploitation requires user interaction from someone other than the attacker. Successful exploitation can cause Oracle VM VirtualBox to hang or crash repeatedly, impacting availability. The vulnerability has a CVSS 3.1 base score of 5.9, indicating a medium severity level.

CVE-2026-87301 is a vulnerability in Oracle VM VirtualBox version 7.2.16 that allows a low privileged attacker with logon access to the infrastructure to compromise the product. Successful exploitation can lead to unauthorized access to critical data and cause denial of service by crashing Oracle VM VirtualBox. The vulnerability has a high severity with a CVSS 3.1 base score of 8.4, impacting confidentiality and availability.

CVE-2026-101735 is a vulnerability in Oracle Primavera Unifier (Project Control component) versions 23.12.0 through 23.12.16. It allows a low-privileged attacker with network access via HTTP to compromise the application. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical or accessible data, as well as unauthorized read access to some data. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with confidentiality and integrity impacts.

CVE-2026-101500 is a vulnerability in Oracle Global Lifecycle Management OPatchAuto affecting versions 12.2.0.1.16 through 12.2.0.1.52. It allows a high privileged attacker with logon access to the infrastructure to compromise the OPatchAuto component. Exploitation requires user interaction from a person other than the attacker. The vulnerability impacts confidentiality, integrity, and availability with a CVSS 3.1 base score of 6.5.

Python virtualenv versions including 1.10.1-1 through 15.1.0+ds-2build1 contain a high severity vulnerability (CVE-2026-113725) with a CVSS score of 7.8. This vulnerability affects the confidentiality, integrity, and availability of the system and requires local attack vector with low complexity and no privileges but user interaction. No public exploit or vendor patch information is provided.

A medium severity vulnerability (CVE-2026-113724) affects multiple specific versions of the python-virtualenv tool, which is used to create isolated Python environments. The vulnerability has a CVSS 3.1 base score of 4.5, indicating limited impact with low privileges required and no user interaction needed. It impacts confidentiality, integrity, and availability to a low degree. No public exploits or patches are currently documented.

A high-severity vulnerability (CVE-2026-113722) affects multiple specific versions of the python-virtualenv tool, which is used for creating isolated Python environments. The vulnerability has a CVSS 3.1 score of 7.8, indicating significant impact on confidentiality, integrity, and availability. The affected versions include various releases from 1.10.1-1 through 15.1.0+ds-2build1. No public exploit code or known exploitation in the wild has been reported. No patch or remediation information is provided in the available data.

A medium severity vulnerability (CVE-2026-113721) affects multiple specific versions of the python-virtualenv tool, which is used to create isolated Python environments. The vulnerability has a CVSS 3.1 score of 4.5, indicating limited impact with low privileges required and no user interaction needed. The affected versions include various Debian and Ubuntu package builds. No public exploit or known active exploitation is reported. No patch or remediation details are provided in the available data.

A medium-severity vulnerability (CVE-2026-113719) affects specific versions of the Python virtualenv tool, which is used to create isolated Python environments. The vulnerability has a CVSS 3.1 base score of 4.5, indicating limited impact on confidentiality, integrity, and availability. It requires local access with low privileges and high attack complexity, with no user interaction needed. The affected versions include multiple specific package builds primarily associated with Ubuntu distributions. No public exploits or known active exploitation have been reported. No patch or remediation information is provided in the source data.

CVE-2026-113716 is a medium severity vulnerability in python-virtualenv, a tool for creating isolated Python environments. It affects multiple specific package versions. The vulnerability has a CVSS 3.1 base score of 4.5, indicating limited impact on confidentiality, integrity, and availability. No public exploits or vendor patches are currently documented.

CVE-2026-113715 is a low severity vulnerability affecting specific versions of the python-virtualenv tool, which is used to create isolated Python environments. The CVSS 4.0 score is 2.0, indicating low impact with local attack vector, high attack complexity, and partial privileges required. No public exploit or known active exploitation is reported. The affected versions include various specific package builds primarily for Ubuntu distributions.

A vulnerability in the follow-redirects Node.js library versions 1.16.0 up to but not including 1.16.1 allows sensitive credential headers such as Authorization, Proxy-Authorization, and Cookie to be exposed to unauthorized remote servers. This occurs because the header removal logic fails when headers are provided as an array, causing these sensitive headers to be forwarded during cross-origin redirects without warning. The issue is fixed in version 1.16.1.

Vite versions prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3 have a vulnerability affecting applications using custom middleware that pass an unchanged browser request URL to server.transformIndexHtml. This flaw allows an attacker to craft a development-server page that causes the victim's browser to fetch and execute an attacker-controlled module, potentially exposing sensitive page data or enabling critical actions. The issue is fixed in the specified versions.

A medium severity vulnerability (CVE-2026-113681) affects multiple versions of OpenImageIO prior to 3.0.20.0, 3.1.15.0, and 3.2.x before 3.x.x. The flaw has an impact on availability but does not affect confidentiality or integrity. No public exploits or known active exploitation have been reported. The affected versions include several specific builds of OpenImageIO 2.2.x, 2.4.x, and 2.5.x series.

HarfBuzz versions from 8.0.0 through 14.6.0 contain a vulnerability that leads to a NULL pointer dereference. This flaw can cause a denial of service by crashing the affected application. The vulnerability has a CVSS 3.1 base score of 5.5, indicating a medium severity level. It requires local attack vector with low complexity and no privileges, but user interaction is required. There is no indication of confidentiality or integrity impact, only availability is affected.

CVE-2026-90800 is a critical vulnerability in Apache CouchDB 3.5.2 and related versions, involving missing authorization checks in the chttpd component. This flaw allows unauthorized network attackers to potentially gain high-impact access without user interaction. The vulnerability has a high CVSS 4.0 score of 9.4, indicating severe risk. The affected version explicitly noted is 1.6.0-0ubuntu7. No public exploits or known active exploitation have been reported. Patch or remediation details are not provided in the available data.

CVE-2026-90799 is a medium severity vulnerability involving unsafe binary deserialization in the chttpd component of Apache CouchDB. It affects at least version 1.6.0-0ubuntu7. The vulnerability allows an attacker with low privileges to cause a denial of service or potentially other impacts due to improper handling of serialized data. No public exploits or known active exploitation have been reported. The vulnerability was published on October 23, 2026.

CVE-2026-90798 is a low-severity vulnerability in Apache CouchDB 3.5.2 and specifically affects version 1.6.0-0ubuntu7. It involves a missing circuit-breaker in the replicator component, which could potentially lead to limited impact under certain conditions. The vulnerability has a CVSS 4.0 base score of 2.3, indicating low risk. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.