Threats Tagged 'cve-2026-60672'

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients. Security Fix(es): * google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186) * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2026-60672 is a critical vulnerability in Oracle WebLogic Server allowing an unauthenticated attacker with network access via T3 or IIOP protocols to compromise the server. Successful exploitation can lead to full takeover of the Oracle WebLogic Server. The vulnerability affects specific versions of Oracle WebLogic Server and has a CVSS 3.1 base score of 9.8, indicating severe confidentiality, integrity, and availability impacts. Oracle has released security patches addressing this vulnerability as part of their August 2026 Critical Security Patch Update.