Search: 5.1.8.7

CVE-2025-60478 is a use-after-free vulnerability in the gf_filter_packet_destroy function of GPAC Project/MP4Box before version 2.5. This flaw can be triggered by processing a crafted MPEG-2 file, leading to a denial of service (DoS) condition. The issue is fixed in version 2.5.

CVE-2025-60497 is a medium severity vulnerability in GPAC Project/MP4Box before version 2.5. It involves a segmentation violation in the GetESD function within the /isomedia/track.c file. An attacker can trigger a Denial of Service (DoS) by supplying a crafted MP4 file. The issue is fixed in version 2.5.

CVE-2025-71438 is an out-of-bounds read vulnerability in the GPAC Project's MP4Box component prior to version 26.07.0. The flaw exists in the gf_odf_ac4_cfg_dsi_v1 function within the /odf/descriptors.c file. An attacker can trigger a denial of service (DoS) by supplying a specially crafted AC4 file. This vulnerability has a medium severity rating with a CVSS score of 5.5. The issue is fixed in version 26.07.0.

CVE-2026-113707 is a race condition vulnerability in the a2aproject a2a-rs software, specifically in the InMemoryTaskStore::update function within the a2a-server/src/task_store/inmemory.rs file. This flaw affects versions 0.4.0 through 0.4.4 and can be exploited remotely. The vulnerability has a medium severity rating with a CVSS score of 5.3. A patch identified by commit 7050c7d329238539424ee46440e23b91c4825bee is available to address this issue.

CVE-2026-109682 is a server-side request forgery (SSRF) vulnerability in Rapid7 Metasploit Framework versions before 6.5.7. It allows HTTP requests made via the send_request_cgi! method to follow redirects to arbitrary hosts without restriction. This can enable a malicious HTTP server to induce the Metasploit operator's system to access internal or otherwise inaccessible HTTP services.

A high-severity vulnerability (CVE-2026-91484) exists in the Java plugin component of Oracle Java SE, specifically affecting OpenJDK 8 versions listed. The vulnerability has a CVSS 3.1 score of 7.5, indicating high impact on confidentiality and integrity with no impact on availability. It requires local attack vector, high attack complexity, and low privileges without user interaction. No public exploits or cloud service implications are reported.

CVE-2026-87322 is a high-severity vulnerability in Oracle VM VirtualBox affecting multiple 5.0.x dfsg versions. It has a CVSS v3.1 score of 8.4, indicating a significant risk with high impact on confidentiality, integrity, and availability. The vulnerability requires high privileges and no user interaction but can be exploited remotely over an adjacent network. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.

CVE-2026-87311 is a medium severity vulnerability in Oracle VM VirtualBox affecting multiple specific 5.0.x versions. It has an attack vector requiring local access with high attack complexity and low privileges, causing a high impact on availability but no confidentiality or integrity impact. The vulnerability was published on October 23, 2026. No known exploits or patches are currently documented.

A medium severity vulnerability (CVE-2026-87303) affects specific versions of Oracle VM VirtualBox. The flaw has a CVSS 3.1 base score of 5.9, indicating limited impact on confidentiality and integrity but a significant impact on availability. The vulnerability requires local access with low privileges and user interaction to exploit. No known exploits are reported in the wild, and no official patch or remediation details are provided in the available data.

A high-severity vulnerability (CVE-2026-87301) affects multiple specific versions of Oracle VM VirtualBox. The flaw has a CVSS 3.1 base score of 8.4, indicating significant impact on confidentiality and availability with low attack complexity and no user interaction required. The vulnerability allows local attackers with low privileges to cause a high impact on confidentiality and availability. No public exploits or known active exploitation have been reported. The affected versions are specific builds of VirtualBox 5.0.x series.

CVE-2026-87294 is a medium severity vulnerability affecting specific versions of OpenJDK 8, including various Ubuntu package builds. The vulnerability impacts Oracle Java SE and Oracle GraalVM for JDK. It has a CVSS 3.1 base score of 6.5, indicating a network exploitable flaw with low complexity and no required privileges or user interaction, causing limited confidentiality and integrity impacts but no availability impact. No public exploit or known active exploitation is reported. No patch or remediation details are provided in the available data.

A medium severity vulnerability (CVE-2026-87293) exists in Oracle Java SE's RMI component affecting multiple OpenJDK 8 versions. The flaw allows remote attackers to cause partial confidentiality and integrity loss without authentication. The vulnerability has a CVSS 3.1 base score of 5.4, indicating a network attack vector with high attack complexity and no privileges required. No public exploits or known active exploitation have been reported. Affected versions include specific OpenJDK 8 update builds primarily found in Ubuntu distributions.

CVE-2026-87290 is a medium severity vulnerability affecting specific builds of OpenJDK 8, including versions distributed with Ubuntu 16.04 through 26.04 LTS. The vulnerability impacts Oracle Java SE and Oracle GraalVM for JDK. It has a CVSS 3.1 base score of 5.9, indicating a network attack vector with high complexity and no privileges required, resulting in high confidentiality impact but no integrity or availability impact. No public exploits or known active exploitation have been reported.

CVE-2026-113730 is a medium severity vulnerability in the OGNL (Object Graph Navigation Library) for Java affecting specific versions 2.7.3-5 through 2.7.3-9. The vulnerability has a CVSS score of 5.6, indicating a network attack vector with high attack complexity and no privileges or user interaction required, impacting confidentiality, integrity, and availability to a low extent. No public exploit or known active exploitation is reported. The affected versions are explicitly identified, but no patch or remediation details are provided in the available data.

A high-severity vulnerability (CVE-2026-83404) affects multiple specific versions of the MySQL Connector/Python product from Oracle MySQL. The flaw has a CVSS 3.1 base score of 7.5, indicating it can be exploited remotely without privileges or user interaction to cause a high impact on confidentiality. The vulnerability was published on October 23, 2026. No public exploits or known active exploitation have been reported. The affected versions are explicitly listed and include various builds from versions 2.0.4-1 through 26.7.0-1.

CVE-2026-83387 is a medium severity vulnerability affecting specific versions of OpenJDK 8, including various Ubuntu package builds. The vulnerability impacts Oracle Java SE and Oracle GraalVM for JDK. It has a CVSS 3.1 base score of 5.9, indicating a network attack vector with high complexity and no privileges required, resulting in high confidentiality impact but no integrity or availability impact.

CVE-2026-83374 is a medium severity vulnerability affecting specific builds of OpenJDK 8, including various Ubuntu package versions. The vulnerability impacts Oracle Java SE and Oracle GraalVM for JDK. It has a CVSS 3.1 base score of 5.9, indicating a network attack vector with high attack complexity and no privileges or user interaction required. The impact is limited to integrity, with no confidentiality or availability impact reported.

CVE-2026-101803 is a security vulnerability affecting MySQL Server and MySQL Cluster, specifically related to the Server XML component. It impacts multiple MySQL versions including 8.0, 8.4, and 9.7, as well as various Ubuntu-packaged versions of MySQL 5.5. The vulnerability is classified as medium severity. Oracle has included this issue in its October 2026 Critical Patch Update, which contains numerous security patches across many products. No public exploit code or in-the-wild exploitation has been reported. Oracle strongly recommends applying the available patches promptly to mitigate the risk.

CVE-2026-101802 is a vulnerability affecting MySQL Server and MySQL Cluster, specifically in the server parser component. It impacts multiple versions including MySQL 8.0, 8.4, and 9.7, as well as various Ubuntu 5.5 builds. The vulnerability was published on October 26, 2026, and is rated with medium severity. Oracle has included this vulnerability in its October 2026 Critical Patch Update, which contains numerous security patches across many products. Oracle strongly recommends applying available patches promptly to mitigate risks associated with this and other vulnerabilities.

CVE-2026-101801 is a medium severity vulnerability affecting MySQL Server and MySQL Cluster, specifically the Server Optimizer component. It impacts multiple versions of MySQL including 8.0, 8.4, and 9.7, as well as various Ubuntu-packaged versions of MySQL 5.5. Oracle has included this vulnerability in its October 2026 Critical Patch Update, which contains numerous security patches across many Oracle products. Oracle strongly recommends applying the available security patches promptly to mitigate this and other vulnerabilities.