CVE-2026-60792 is a high-severity vulnerability in Oracle Siebel CRM Deployment (Server Infrastructure component) affecting versions 17.0 through 26.6. It allows an unauthenticated attacker with network access via HTTP to potentially create, delete, modify, or access critical data within the Siebel CRM Deployment. The vulnerability is difficult to exploit but can lead to unauthorized access and data manipulation. The CVSS 3.1 base score is 7.4, indicating significant confidentiality and integrity impacts. Oracle has published a Critical Security Patch Update advisory covering this and many other vulnerabilities but does not explicitly confirm patch availability for this specific issue in the provided content.
CVE-2026-60791 is a high-severity vulnerability in Oracle Siebel CRM Deployment (Application Interface component) affecting versions 17.0 through 26.6. It allows an unauthenticated attacker with access to the physical communication segment attached to the hardware running Siebel CRM Deployment to compromise the system. Successful exploitation can lead to unauthorized creation, deletion, or modification of critical data or full access to all data accessible by the deployment. The vulnerability has a CVSS 3.1 base score of 8.1, reflecting high confidentiality and integrity impacts but no availability impact.
CVE-2026-60779 is a high-severity vulnerability in Oracle Siebel Apps - Marketing versions 17.0 through 26.6. It allows a low privileged attacker with network access via HTTP to perform unauthorized creation, deletion, or modification of critical data. Additionally, the vulnerability can cause a hang or repeated crash, resulting in a denial of service. The vulnerability has a CVSS 3.1 base score of 8.1, indicating significant integrity and availability impacts.
CVE-2026-60754 is a critical vulnerability in Oracle Siebel Apps - Marketing versions 17.0 through 26.6. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical data or cause a denial of service by hanging or crashing the application. The vulnerability has a CVSS 3.1 base score of 9.1, indicating high confidentiality and availability impact.
CVE-2026-66782 is a medium severity vulnerability in the Submariner operator component of Red Hat Advanced Cluster Management for Kubernetes 2.16. It involves improper privilege management where a long-lived broker service account bearer token is exposed within the Submariner Custom Resource specification. An attacker with access to the cluster's etcd database or the ability to run 'kubectl get' commands could obtain this token, which grants full control over the mesh network and management of network resources such as endpoints and secrets. Red Hat has addressed this issue in version 2.17 with security fixes and updated container images.
This advisory addresses multiple security vulnerabilities in the Red Hat Enterprise Linux 9.6 kernel live patch module targeted for kernel-5.14.0-570.17.1.el9_6. The vulnerabilities include issues in IPv6 ICMP handling, distributed lock manager length validation, netfilter flowtable action limits, IPv6 inner header offset desynchronization, and a use-after-free condition in network scheduling. These flaws have been rated with an important security impact by Red Hat.
CVE-2026-70657 is an incorrect authorization vulnerability in copyparty, a portable file server. Versions prior to 1.20.17 allow a combination of directory-key and file-key flags to convert a valid file key into a directory key, granting unintended read access to the containing folder. This issue requires manual enabling of both filekeys and dirkeys simultaneously. The vulnerability is fixed in version 1.20.17.
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17.
SiYuan before version 3.7.4 has a vulnerability in 17 block metadata and content endpoints within kernel/api/block.go. These endpoints lack proper authorization checks and publish-access filtering, allowing anonymous users to access private block content and metadata without authentication. This issue affects handlers such as getRefText, checkBlockExist, and getBlockBreadcrumb.
CVE-2026-15585 is a path traversal vulnerability in AKINSOFT Wolvox9 ERP's KontrolPanel.exe component. It allows an attacker to improperly access files outside of a restricted directory. The vulnerability affects versions from s26.02.17 up to but not including 26.02.22. The CVSS score is 7.5, indicating high severity. There is no information about available patches or vendor advisories. No known exploits are reported in the wild.
CVE-2026-52481 is a vulnerability in the SJRC F11 SJ-GPS-PRO firmware build dated 2019-09-17. It allows a remote attacker to obtain sensitive information through the tcp_actions() function. The vulnerability has a high severity rating with a CVSS score of 7.5, indicating a significant confidentiality impact without affecting integrity or availability.
CVE-2026-52480 is a vulnerability in the SJRC F11 SJ-GPS-PRO firmware build dated 2019-09-17. It allows a remote attacker to obtain sensitive information via the inetd service. The vulnerability has a CVSS score of 6.5, indicating a medium severity level. No specific affected versions beyond the stated firmware build date are provided. There is no information about available patches or vendor advisories.
Deskflow versions from 1.17.0 up to continuous build 1.26.0.296 contain a vulnerability where a malicious Deskflow server can send a malformed DSOP vector causing a client crash. This is due to reading beyond the vector boundary during handshake message parsing. The issue is fixed starting with continuous build 1.26.0.296.
Deskflow versions from 1.17.0 up to but not including continuous build 1.26.0.300 contain a vulnerability where a connected peer can send repeated clipboard data messages that cause memory exhaustion on the server or client. This occurs because data is appended beyond the declared size and clipboard limit before validation. The issue is fixed starting with continuous build 1.26.0.300.
CVE-2026-63670 is a cross-site scripting (XSS) vulnerability in apostrophecms apostrophe affecting versions prior to 2.17.6. It arises when the 'textarea' or 'xmp' tags are included in the allowedTags configuration of the sanitize-html library. Due to a parser discrepancy and unescaped raw-text handling, malicious markup such as <img> tags with event handlers can bypass sanitization and execute in browsers. The default configuration is not affected. The vulnerability has medium severity with a CVSS score of 6.1.
Consul Community Edition and Consul Enterprise versions 1.2.0 through 2.0.2 contain an uncontrolled resource consumption vulnerability in the Connect CA roots endpoint. This flaw allows a remote caller to cause the agent's Connect CA roots cache to grow without limit, bypassing the operator's cache-disable configuration. The issue is resolved in Consul 2.0.3 and Consul Enterprise versions 1.21.17, 1.22.11, and 2.0.3.
Consul Community Edition and Consul Enterprise versions 1.17.0 through 2.0.2 contain an uncontrolled resource consumption vulnerability in the Connect authorization endpoint. This flaw allows an attacker to increase the agent's intention-match cache size without limit, bypassing the operator's cache-disable settings. The issue is addressed in Consul 2.0.3 and later versions of Consul Enterprise including 1.21.17, 1.22.11, and 2.0.3.
Consul Community Edition and Consul Enterprise versions 1.18.0 through 2.0.2 contain an authenticated denial of service vulnerability in the Enterprise-to-Community Edition downgrade path. An authorized user with config-entry write permission can submit a specially crafted service-router configuration entry that causes the Consul agent to exit unexpectedly, crashing the server. This issue is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
A vulnerability has been found in Evergreen up to 3.14.11/3.15.11/3.16.5/3.17-beta1. The affected element is an unknown function of the file /osrf-gateway-v1 of the component open-ils.fielder OpenSRF Service. Such manipulation leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.14.12, 3.15.12, 3.16.6 and 3.17-beta2 is sufficient to fix this issue. The affected component should be upgraded.