| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity. While the vulnerability is in Oracle Capacity, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Capacity accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). |
| Vulnerability in the Oracle Capacity product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity. While the vulnerability is in Oracle Capacity, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Capacity accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). |
| IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing X-Content-Type-Options header allowing MIME type sniffing. |
| IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to conduct HTTP response splitting due to improper neutralization of HTTP headers. |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-82873. |
| Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker to elevate privileges locally. |
| Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
| Improper authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network. |
| Improper control of generation of code ('code injection') in Microsoft Office Excel allows an authorized attacker to disclose information locally. |
| Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network. |
| Missing authentication for critical function in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to elevate privileges over a network. |
| Improper privilege management in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges locally. |
| Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network. |
| Trust boundary violation in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. |
| Insertion of sensitive information into log file in Aspire allows an authorized attacker to disclose information locally. |
| Exposed dangerous method or function in SQL Server allows an authorized attacker to elevate privileges over a network. |
| Authorization bypass through user-controlled key in Entra Device Registration allows an unauthorized attacker to elevate privileges over a network. |
| Out-of-bounds read in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical attack. |
| Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. |
