CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.10.16)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in Oracle WebCenter Portal (Portlet Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle WebCenter Portal. CVSS 3.1 Base Score: 9.8.
Vulnerability in Oracle WebCenter Portal (Portlet Services component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it, resulting in unauthorized access, creation, deletion, or modification of critical data. CVSS 3.1 Base Score: 9.1.
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle Access Manager. CVSS 3.1 Base Score: 9.8.
Vulnerability in Oracle WebCenter Portal (Composer component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. A low-privileged attacker with network access via HTTP can easily exploit it, potentially impacting additional products (scope change). It results in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score: 9.9.
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can easily exploit it to take over Oracle Access Manager. CVSS 3.1 Base Score: 9.8.
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. A high-privileged authenticated attacker with network access via HTTP can compromise Oracle Access Manager, and the attack may significantly impact additional products (scope change).
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via HTTP can compromise Oracle Access Manager, and the attack may significantly impact additional products (scope change).
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can create, delete or modify critical data and gain complete access to Oracle Access Manager data.
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via T3 or IIOP can compromise Oracle Access Manager.
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. A low-privileged attacker with network access via HTTP can modify or delete critical data, gain complete access to it and cause a partial denial of service (partial DoS).
Vulnerability in Oracle Access Manager (Authentication Engine component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Access Manager, and the attack may significantly impact additional products (scope change).
Vulnerability in Oracle Identity Manager (Core component) affecting versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated attacker with network access via HTTP can compromise Oracle Identity Manager.
Vulnerability in Oracle WebLogic Server (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An unauthenticated attacker with network access via T3 or IIOP can compromise the server.
Vulnerability in Oracle WebLogic Server (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An unauthenticated attacker with network access via T3 or IIOP can compromise the server.
Vulnerability in Oracle WebLogic Server (Core component) affecting versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. An unauthenticated attacker with network access via T3 or IIOP can compromise the server.
Http4s (Ember HTTP/1.1 module) prior to 0.23.35 and 1.0.0-M47 did not reject messages containing both Transfer-Encoding and Content-Length headers. This allows an intermediary and Ember to select different body framing rules, enabling HTTP request smuggling.
In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote privilege escalation without additional execution privileges. User interaction is not required for exploitation.
In IP Multimedia Subsystem, there is a possible authentication bypass due to a logic error in the code. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
libwebsockets contains an out-of-bounds write vulnerability in HTTP/2 HPACK path header parsing. The lack of proper validation of user-supplied data results in a write past the end of an allocated buffer.
In DIRAC prior to versions 8.0.79, 9.0.22, and 9.1.10, the checkDataset function in FileCatalogHandler.py forwards an authenticated caller-controlled datasets value to __checkDataset in DatasetManager.py, where datasetName is interpolated into an FC_MetaDatasets SQL query without parameterization. The injected query can control the returned MetaQuery value, which is passed to Python eval and permits command execution.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS