THE LATEST / SECURITY & VULNERABILITIES
Threat News
Recent vulnerabilities and security advisories, straight from the source.
Every cached source, newest first. All entries link to the original publisher.
For severity filtering, choose All CVEs above. Scores are available for NVD entries when supplied by an assessor. A severity filter excludes unscored entries; choose “Unscored / not supplied” to see them. Severity describes technical impact, not exploitation or risk.
16,309 stories · Past 30 days · Newest first
Subscribe to this view · RSSSource updates · Some delayed
- NVDUpdates delayed · Checked
- CISA · Known ExploitedUp to date · Checked
- CISA · IndustrialUpdates delayed · Checked
- CERT-EUUp to date · Checked
Sources refresh hourly; NVD every two hours. Available stories remain readable while a source recovers.
- NVD
CVE-2026-101378 — Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N).
CVE-2026-101378Read original ↗ (opens in a new tab) - NVD
CVE-2026-101377 — Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26…
Low · CVSS 3.1 2.7 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle REST Data Services. CVSS 3.1 Base Score 2.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:…
CVE-2026-101377Read original ↗ (opens in a new tab) - NVD
CVE-2026-101376 — Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26…
Medium · CVSS 3.1 4.7 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data and unau…
CVE-2026-101376Read original ↗ (opens in a new tab) - NVD
CVE-2026-101375 — Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26…
Medium · CVSS 3.1 6.3 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data and unaut…
CVE-2026-101375Read original ↗ (opens in a new tab) - NVD
CVE-2026-101374 — Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.…
Medium · CVSS 3.1 5.9 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:…
CVE-2026-101374Read original ↗ (opens in a new tab) - NVD
CVE-2026-101373 — Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily…
Low · CVSS 3.1 2.4 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 2.4 (Int…
CVE-2026-101373Read original ↗ (opens in a new tab) - NVD
CVE-2026-101372 — Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Diffic…
Low · CVSS 3.1 3.7 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2026-101372Read original ↗ (opens in a new tab) - NVD
CVE-2026-101371 — Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Diffic…
Low · CVSS 3.1 3.1 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized rea…
CVE-2026-101371Read original ↗ (opens in a new tab) - NVD
CVE-2026-101370 — Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Diffic…
Low · CVSS 3.1 3.1 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality i…
CVE-2026-101370Read original ↗ (opens in a new tab) - NVD
CVE-2026-101369 — Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.…
Medium · CVSS 3.1 6.1 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerabil…
CVE-2026-101369Read original ↗ (opens in a new tab) - NVD
CVE-2026-101368 — Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: Backend-as-a-Service). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as un…
CVE-2026-101368Read original ↗ (opens in a new tab) - NVD
CVE-2026-101367 — Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5…
CVE-2026-101367Read original ↗ (opens in a new tab) - NVD
CVE-2026-101366 — Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily…
Medium · CVSS 3.1 4.3 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: ADP). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N).
CVE-2026-101366Read original ↗ (opens in a new tab) - NVD
CVE-2026-101365 — Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26…
Medium · CVSS 3.1 4.7 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data and unau…
CVE-2026-101365Read original ↗ (opens in a new tab) - NVD
CVE-2026-101364 — Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability c…
CVE-2026-101364Read original ↗ (opens in a new tab) - NVD
CVE-2026-101363 — Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that are affected are 24.2.0-26.1.0. Ea…
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
CVE-2026-101363Read original ↗ (opens in a new tab) - NVD
CVE-2026-101362 — Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Diffic…
Medium · CVSS 3.1 6.9 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle REST Data Services, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result…
CVE-2026-101362Read original ↗ (opens in a new tab) - NVD
CVE-2026-101361 — Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Diffic…
Medium · CVSS 3.1 4.2 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Scor…
CVE-2026-101361Read original ↗ (opens in a new tab) - NVD
CVE-2026-101360 — Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily…
Medium · CVSS 3.1 5.4 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data as well as unauthorized read access to a subset of Oracle REST Data Services accessible data. CVSS 3.1 Base Score…
CVE-2026-101360Read original ↗ (opens in a new tab) - NVD
CVE-2026-101359 — Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily…
Medium · CVSS 3.1 5.3 · Assessor: [email protected]
Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
CVE-2026-101359Read original ↗ (opens in a new tab) - NVD
CVE-2025-60496 — A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.…
CVSS unscored / not supplied
A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file.
CVE-2025-60496Read original ↗ (opens in a new tab) - NVD
CVE-2025-60494 — A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before…
CVSS unscored / not supplied
A segmentation violation in the gf_props_equal_internal function (/filter_core/filter_props.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted data file.
CVE-2025-60494Read original ↗ (opens in a new tab) - NVD
CVE-2025-60475 — A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows atta…
CVSS unscored / not supplied
A buffer overflow in the gf_ac4_parser_bs function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted input.
CVE-2025-60475Read original ↗ (opens in a new tab) - NVD
CVE-2026-9869 — A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2026-9869Read original ↗ (opens in a new tab) - NVD
CVE-2026-9827 — A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-G…
Critical · CVSS 3.1 9.1 · Assessor: [email protected]
A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
CVE-2026-9827Read original ↗ (opens in a new tab)
Summaries are excerpts from the publishers. The default Advisories view includes CISA KEV, CISA Industrial and CERT-EU. When several scores exist, PATCHBAY shows the newest valid CVSS version, then prefers a primary assessment, NVD, and a stable assessor ordering. Open the original for all assessments. CISA Known Exploited dates indicate catalog additions. This product uses data from the NVD API but is not endorsed or certified by the NVD.