CVE Vulnerability Catalog

Tanium addressed an uncontrolled resource consumption vulnerability in Interact. The vulnerability involves the potential for excessive consumption of system resources.

Tanium addressed an information disclosure vulnerability in Tanium Server. Technical details of the vulnerability were not disclosed in the description.

Tanium addressed an information disclosure vulnerability in Threat Response.

An authorization bypass vulnerability was identified in GitHub Enterprise Server that allowed an attacker with admin access on one repository to modify the secret scanning push protection delegated bypass reviewer list on another repository by manipulating the owner_id parameter in the request body. Authorization was verified against the repository in the URL, but the action was applied to a different repository specified in the request body. The impact is limited to assigning existing trusted users as bypass reviewers; it does not allow adding arbitrary external users.

nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear variables from the previous profile before loading the next. Additive dotenv reload behavior allows access to provider API keys and other secrets across profile contexts.

Vulnerability in Oracle VM VirtualBox (component: Core), affecting version 7.2.6. An easily exploitable flaw allows a high-privileged attacker with logon to the infrastructure to cause a partial denial of service (partial DoS) of Oracle VM VirtualBox.

Vulnerability in Oracle VM VirtualBox (component: Core), affecting version 7.2.6. An easily exploitable flaw allows a high-privileged attacker with logon to the infrastructure to gain unauthorized update, insert, or delete access to some Oracle VM VirtualBox accessible data; attacks may significantly impact additional products (scope change).

A vulnerability in the RDBMS component of Oracle Database Server affects versions 19.3-19.30. A high-privileged attacker with Row Access Method privilege and network access can exploit it, but human interaction is required. Successful attacks may result in unauthorized read access to a subset of RDBMS data (CVSS 2.4).

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: Security). A difficult-to-exploit flaw allows an unauthenticated attacker with logon to the infrastructure to gain unauthorized read access to a subset of data.

A vulnerability was found in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition in the Libraries component. A difficult-to-exploit network attack can allow an unauthenticated attacker to cause a partial denial of service (partial DoS). The vulnerability affects specific versions and can be exploited through APIs in the component, e.g., via a web service supplying data to the APIs.

A vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Workflow and Business Events) affects versions 12.2.7-12.2.15. An easily exploitable flaw allows a high-privileged attacker with network access via HTTP to gain unauthorized update, insert or delete access to some data and unauthorized read access to a subset of data.

A vulnerability in Oracle Java SE Libraries (version 25.0.1) allows an unauthenticated attacker with network access to update, insert, or delete some accessible data. It is difficult to exploit and primarily affects client deployments running untrusted code in a sandbox (e.g., applets, Web Start), not servers running trusted code.

Vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition (component: Security). A difficult-to-exploit flaw allows an unauthenticated attacker with logon to the infrastructure to gain unauthorized read access to a subset of data.

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Information Schema). Supported versions affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. An easily exploitable vulnerability allows a high privileged attacker with network access to gain unauthorized read access to a subset of MySQL Server data.

In mailcow versions prior to 2026-03b, the web interface passes the raw $_SERVER['REQUEST_URI'] to Twig as a global template variable and renders it inside a JavaScript string literal in the setLang() helper of base.twig, relying on Twig's default HTML auto-escaping instead of context-appropriate JS escaping. Additionally, the query_string() Twig helper merges all current $_GET parameters into the language-switching links on the login page, so attacker-supplied parameters are reflected and preserved across navigation. Version 2026-03b fixes the vulnerability.

A cross-site scripting vulnerability was found in the Calendar component of WebSystems WebTOTUM 2026. The attack can be initiated remotely and the exploit has been publicly disclosed. The vendor quickly released a fixed version of the product.

In October CMS prior to 3.7.16 and 4.1.16, fine-grained sub-permission checks for asset and blueprint file operations were not enforced in the CMS and Tailor editor extensions. Backend users granted editor access but explicitly denied editor.cms_assets or editor.tailor_blueprints could still create, delete, rename, move, and upload files. A related operator precedence error in Tailor navigation also disclosed the theme blueprint directory tree.

In October CMS prior to 3.7.16 and 4.1.16, a reflected Cross-Site Scripting (XSS) vulnerability was identified in the backend DataTable widget where a query parameter was rendered without proper output escaping. The vulnerability is fixed in 3.7.16 and 4.1.16.

HCL BigFix Service Management is susceptible to HTTP Request Smuggling. HTTP request smuggling vulnerabilities arise when websites route HTTP requests through web servers with inconsistent HTTP parsing. HTTP Smuggling exploits inconsistencies in request parsing between front-end and back-end servers, allowing attackers to bypass security controls and perform attacks like cache poisoning or request hijacking.

PcManager is affected by a type privilege bypass vulnerability. Successful exploitation may affect service availability.