Week 35, 2026

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of…

Product not named

ipv6: account for fraggap on the paged allocation path

Linux · Linux

Authenticated users may write data outside the intended Docker cache path

jfrog · artifactory

Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service

NetScaler · ADC

A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server…

Microsoft · Microsoft SQL Server 2014 Service Pack 2 for 32-bit Systems (GDR)

Deserialization of Untrusted Data

AjaxPro.2

An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel…

kernel

The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a…

Product not named

libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local…

Product not named

Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Gitea · Gitea

Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middleware (component: Weblogic Server Proxy Plug-in for…

Oracle Corporation · Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in

Unauthenticated Remote Code Execution in GraphQL Composite Data API

ServiceNow · ServiceNow AI Platform

Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause

ServiceNow · ServiceNow AI Platform

Unauthenticated Privilege Escalation via System Configuration Image Upload Processor

ServiceNow · ServiceNow AI Platform

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Adobe · Adobe Campaign Classic

Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

Adobe · Adobe Campaign Classic

argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP

argoproj-labs · argocd-mcp

WordPress GiveWP plugin <= 4.16.7.1 - Remote Code Execution (RCE) vulnerability

Liquid Web / StellarWP · GiveWP

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Talk Application to execute a Command…

Ubiquiti Inc · UniFi Talk Application

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command…

Ubiquiti Inc · UniFi Protect Application

EFM ipTIME T16000M Session Validation httpcon_check_session_url improper authentication

EFM · ipTIME T16000M