CVE Vulnerability Catalog

Vulnerability in the Optimizer component of MySQL Server and MySQL Cluster. A high-privileged attacker can remotely cause a hang or frequent crashes (full DOS).

Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, but due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final.

Vulnerability in libheif before version 1.22.0. Decoding a malicious HEIF file without an `ispe` property (but with `uncC`) causes a crash in `heif_image_handle_get_image_tiling()` – via assertion in debug builds or null pointer read in release/ASan builds.

Vulnerability in libheif before version 1.22.0 causes a heap buffer overflow when reading HEIF/AVIF files. The Track::init_sample_timing_table() function stores an invalid chunk index, leading to an out-of-bounds read.

Vulnerability in libheif before version 1.22.0. The fix for CVE-2026-3949 introduced an integer overflow in the security check, allowing bypass and triggering an out-of-bounds heap read via a crafted HEIF file with a VVC track.

Vulnerability in libheif versions 1.19.0 through 1.21.2 allows a heap out-of-bounds write in the uncompressed tile decoder. A crafted HEIF file can overwrite the vtable pointer, leading to code execution.

Vulnerability in MySQL Server and MySQL Cluster (component: Server: Optimizer) in multiple versions. Easily exploitable flaw allows a low-privileged attacker with network access via multiple protocols to cause a hang or frequent repeatable crash (complete DOS) of MySQL Server or Cluster.

Vulnerability in Oracle VM VirtualBox (component: Core) version 7.2.12. It is easily exploitable, requires local access and low privileges. Successful attack can cause a hang or frequent crashes (full DOS) of VirtualBox.

Vulnerability in the JDBC component of Oracle Database Server allows an unauthenticated attacker with access to the communication segment to gain unauthorized access to critical data. Requires user interaction.

Vulnerability in the JDBC component of Oracle Database Server (versions 19.3-19.31, 21.3-21.22, 23.4.0-23.26.2). An unauthenticated attacker via Oracle Net, requiring user interaction, can gain unauthorized access to critical data (modify, delete, create).

Easily exploitable vulnerability in Oracle VM VirtualBox 7.2.12, requiring user interaction. A low-privileged attacker can modify critical data and cause partial denial of service.

Vulnerability in Oracle MySQL's MySQL Server and MySQL Cluster products (component: InnoDB). Affected versions include MySQL Server 8.4.0-8.4.10, 9.7.0-9.7.1 and MySQL Cluster 8.0.0-8.0.47, 8.4.0-8.4.10, 9.7.0-9.7.1. Easily exploitable by a high-privileged attacker with network access via multiple protocols, potentially causing a hang or frequent crash (full DOS) of the server or cluster.

Vulnerability in PeopleSoft Enterprise PeopleTools (Security component) allows a low-privileged attacker via HTTP to gain unauthorized read and modify access to data. Requires user interaction.

Vulnerability in Oracle PeopleSoft Enterprise PeopleTools, component PIA Core Technology. Affects versions 8.61 and 8.62. Allows a high-privileged attacker with network access via HTTP to gain unauthorized access to critical data or all PeopleTools data.

Vulnerability in PeopleSoft Enterprise PeopleTools (Security component) allows a low-privileged attacker via HTTP to gain unauthorized read and modify access to data. Requires user interaction.

Vulnerability in the JDBC component of Oracle Database Server in versions 19.3-19.31, 21.3-21.22, and 23.4.0-23.26.2. Easily exploitable flaw requires human interaction and allows a high-privileged attacker with network access via Oracle Net to take over the JDBC component.

Vulnerability in Oracle VM VirtualBox version 7.2.12 (Core component). Easily exploitable by an attacker with low privileges and local access. Can cause complete denial of service (DOS) through hangs or frequent crashes.

Vulnerability in Oracle VM VirtualBox 7.2.12 allows a high-privileged attacker with local access to cause a hang or frequent crash (DOS) of the VM. Attacks may impact additional products.

Vulnerability in the Java VM component of Oracle Database Server allows a low-privileged attacker with Create Session privilege and network access via Oracle Net to unauthorized create, delete, or modify critical data. The attack is easy to exploit.

Vulnerability in Oracle Java SE (component: Libraries) allows an unauthenticated attacker with network access to cause a partial denial of service (partial DOS). The attack is easy to exploit and can be triggered via APIs, e.g., through a web service.