Threat Intelligence Database

CVE-2026-101386 is a vulnerability in Oracle REST Data Services Core component affecting versions 24.2.0 through 26.1.0. It allows a low privileged attacker with network access via HTTP to perform unauthorized read, update, insert, or delete operations on some accessible data. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.2, indicating limited confidentiality and integrity impact. The vulnerability is difficult to exploit due to the required conditions. Oracle has released patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update.

CVE-2026-101384 is a vulnerability in Oracle REST Data Services Core component affecting versions 24.2.0 through 26.1.0. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some data accessible through Oracle REST Data Services. The vulnerability has a CVSS 3.1 base score of 5.0, indicating a medium severity with confidentiality impact only. The vulnerability may also impact additional Oracle products due to scope change. Oracle has published a Critical Patch Update advisory that includes security patches addressing this and other vulnerabilities.

CVE-2026-101383 is a vulnerability in Oracle REST Data Services Core component affecting versions 24.2.0 through 26.1.0. It allows an unauthenticated attacker with network access via HTTP to compromise the service. Successful exploitation requires human interaction from a person other than the attacker. The vulnerability can lead to unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of data. The CVSS 3.1 base score is 5.4, indicating a medium severity level.

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected.  Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.

CVE-2026-76646 is a high-severity vulnerability in Apache MyFaces that allows a remote attacker to cause uncontrolled resource consumption by sending specially crafted request parameters. This can lead to a denial of service (DoS) condition. The issue affects multiple versions of Apache MyFaces, and fixed versions have been released. Users are advised to upgrade to the specified fixed versions to mitigate the risk.

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.

Silverpeas Core versions up to and including 6.4.6 contain a Cross Site Scripting (XSS) vulnerability in the Multimedia library application introduction component. This vulnerability allows an attacker to inject malicious scripts that could be executed in the context of a user's browser session. The vulnerability has a medium severity rating with a CVSS score of 6.1. No official patch or remediation information is provided in the available data.

Silverpeas Core versions up to and including 6.4.6 contain a Cross Site Scripting (XSS) vulnerability in the wysiwyg-CKEditor image upload feature. This vulnerability allows an attacker to inject malicious scripts that can be executed in the context of the affected application. The vulnerability has a CVSS score of 6.1, indicating a medium severity level.

Silverpeas Core version 6.4.6 contains a Cross Site Scripting (XSS) vulnerability in its Document management file upload feature. This vulnerability allows an attacker to execute malicious scripts in the context of a user's browser session. The vulnerability has a medium severity rating with a CVSS score of 6.1.

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.