Latest Security Vulnerabilities

Wednesday July 22, 2026

Veeam

CVE-2026-56844 LPE via Veeam Updater in Veeam Software Appliance

Red Hat Enterprise Linux (RHEL)

CVE-2026-16473 BlueZ SBC Frame Decoder OOB Heap Read
 

Unclassified

CVE-2026-3821 SMC X14DBG-DAP/X14DBI 01.00.16.00 & 1.03.02.06 ATE via SMASH services
CVE-2026-63047 Joomla Events Booking 5.05.8.1 Invoice Download Authorization Bypass
CVE-2026-63048 Joomla Page Builder CK 1.0.0-3.6.2 Arbitrary File Upload RCE
CVE-2026-45820 DDoS via infinite loop in fflate <0.8.3 unzipSync()
CVE-2026-12968 WP PlugIn: Product Addons & Options <1.6.15 Unauth SVG Upload Exec
CVE-2026-12987 PHP OI in Events Manager WP Plugin <7.3.7: DB Exfil via No-User-Account
CVE-2026-15802 WP Foodbakery v<=4.9 Arbitrary File Deletion via delete_locations_backup_file_callback
CVE-2026-14322 Timetics WP Plugin <1.0.57 Unauthenticated Booking Creation
CVE-2026-14551 ServerEye Agent <20.15 LP Escalation via SE3Recovery
And others...

Brainstormforce Ultimate Addons For Elementor

CVE-2026-15787 XSS in Ultimate Addons for Elementor Nav Menu Widget (<=2.9.1)

Umijs Umi

CVE-2026-16492 Umijs Umi <=4.6.63: GIT File Helper OS command injection

Itsourcecode Hospital Management System

CVE-2026-16490 CVE-2026-16490

Tuesday July 21, 2026

Google Chrome

CVE-2026-16413 ANGLE OOB write in Chrome <=150.0.7871.182, sandbox escape via crafted HTML page
CVE-2026-16418 V8 Stack Buffer Overflow in Chrome <150.0.7871.182 (Remote Code Exec)
CVE-2026-16419 Chrome ANGLE OOB Read/Write Sandbox Escape v<150.0.7871.182 (Android)
CVE-2026-16423 Chrome UI UAF before 150.0.7871.182
CVE-2026-16420 WebAudio Type Confusion Chrome <150.0.7871.182 Remote Code Execution
CVE-2026-16414 Chrome Chromecast sandbox escape via untrusted input (before 150.0.7871.182)
CVE-2026-16415 Google Chrome <=150.0.7871.182 Omnibox Spoof via Untrusted Input
CVE-2026-16416 Google Chrome <150.0.7871.182 Integer OverFlow in Chromecast Allows SandboxEsc.
CVE-2026-16417 Uninitialized Use in Skia (Chrome <150.0.7871.182)
And others...

Mozilla Firefox

CVE-2026-16402 Firefox Integer Overflow: ImageLib Component (Fixed in v153)
CVE-2026-16394 Firefox DOM Mitigation Bypass in Security Component
CVE-2026-16372 Privilege Escalation in Firefox DOM Content Process Component
CVE-2026-16408 Mozilla Firefox: Integer Overflow in Audio/Video Playback Component
CVE-2026-16403 Address Bar Spoofing Issue in Firefox
CVE-2026-16399 Firefox DOM Navigation Site Isolation Vulnerability
CVE-2026-16391 Mozilla Firefox <153 ESR 140.13: IndexedDB Info Disclosure
CVE-2026-16388 Firefox Sandbox Escape: DOM Networking Component
CVE-2026-16376 DoS via WebGPU in Firefox
And others...
 

Unclassified

CVE-2026-3821 SMC X14DBG-DAP/X14DBI 01.00.16.00 & 1.03.02.06 ATE via SMASH services
CVE-2026-63047 Joomla Events Booking 5.05.8.1 Invoice Download Authorization Bypass
CVE-2026-63048 Joomla Page Builder CK 1.0.0-3.6.2 Arbitrary File Upload RCE
CVE-2026-45820 DDoS via infinite loop in fflate <0.8.3 unzipSync()
CVE-2026-12968 WP PlugIn: Product Addons & Options <1.6.15 Unauth SVG Upload Exec
CVE-2026-12987 PHP OI in Events Manager WP Plugin <7.3.7: DB Exfil via No-User-Account
CVE-2026-15802 WP Foodbakery v<=4.9 Arbitrary File Deletion via delete_locations_backup_file_callback
CVE-2026-14322 Timetics WP Plugin <1.0.57 Unauthenticated Booking Creation
CVE-2026-14551 ServerEye Agent <20.15 LP Escalation via SE3Recovery
And others...

Oracle Java

CVE-2026-62574 Oracle Java SE Install Component Vulnerability (8u49126.0.1)

Oracle MySQL

CVE-2026-61093 Oracle MySQL 9.7.0-9.7.1 Server Optimizer DOS via Multi-Proto
CVE-2026-61096 Pluggable Auth: Unauth Integrity Impact in MySQL 8.4.x-8.4.10,8.0.x-8.0.47,9.7.x
CVE-2026-61109 DoS via JSON in MySQL Server/Cluster 8.4.x10.x
CVE-2026-61144 MySQL Server 9.7.0-9.7.1 Optimizer DoS Vulnerability
CVE-2026-61081 Oracle MySQL Server/Cluster 8.4.0-9.7.1 Performance Schema Unauthorized Read
CVE-2026-61094 Oracle MySQL Server/Cluster 8.4.0-10, 9.7.0-1 Replication RCE (High Priv)
CVE-2026-61108 MySQL Server 9.7.0-9.7.1 GIS DOS Attacks
CVE-2026-61128 MySQL 9.7.x Cluster Optimizer DoS via Net

Oracle Application Object Library

CVE-2026-61116 Oracle Application Object Library (OAL) 12.2.3-12.2.15 Unauthenticated HTTP RCE

Oracle Advanced Benefits

CVE-2026-61141 Oracle Advanced Benefits: HTTP Low-Priv RCE 12.2.7-12.2.15
CVE-2026-61325 Oracle Advanced Benefits 12.2.15 Internal Ops Priv Escalation via HTTP
CVE-2026-61282 Oracle Advanced Benefits 12.2.4-12.2.15 Self Service Benefits Data Leak
CVE-2026-61323 Oracle AdvBenefits 12.2.15 Internal Ops HTTP Low-Priv Access

Oracle Database Rdbms

CVE-2026-61211 Oracle Database Server RDBMS CVE-2026-61211: 19.3-23.26.2 LowPriv Exploit

Oracle Agile Engineering Data Management

CVE-2026-61191 Oracle AEM DMS 6.2.1 Logon Host: Low-Priv Unauth Update & Partial DoS
CVE-2026-61195 Oracle AgilE Data Mgmt 6.2.1 Core DoS via TCP
CVE-2026-61186 Oracle AEM Install v6.2.1 Unauth HTTP Remote DoS (CVE-2026-61186)
CVE-2026-61190 Oracle Agile Eng Data Mgmt 6.2.1 Install CVE: L-P Priv Exploitable via HTTP

Oracle Identity Manager

CVE-2026-61196 Oracle OIM Legacy UI: Unauth HTTP Takeover 12.2.1.4/14.1.2

Oracle Peoplesoft Enterprise Crm Common Objects

CVE-2026-61201 Oracle PeopleSoft 9.2.23 CRM Common Objects RCE via HTTP

Oracle Banking Origination

CVE-2026-61220 Oracle Banking Origination 14.5.0.16.0 config RW flaw via HTTP

Oracle Item Master

CVE-2026-61221 Oracle Item Master iSet-up Bug: low-priv HTTPCVE affecting 12.2.3-12.2.15

Oracle Learning Management

CVE-2026-61249 Oracle EBS LMS 12.2.x Import/Export HTTP Vulnerability

Oracle Hrms

CVE-2026-61251 Oracle EBS HRMS Australia Payroll 12.2.3-12.2.15 CVE-2026-61251: Unauthorized Access
CVE-2026-62456 Oracle HRMS(UK) Int Ops CVE-2026-62456 v12.2.3-12.2.15 Remote Auth Bypass (AV:N)
CVE-2026-62521 Oracle HRMS US Payroll Unauthorized Access, 12.2.7-12.2.15
CVE-2026-62524 Oracle HRMS US Payroll General 12.2.312.2.15 HTTP Low-Priv Exploit
CVE-2026-62549 Oracle HRMS (UK) Abuse: HTTP LPE <12.2.15 (CVSS 9.6)
CVE-2026-62557 Oracle HRMS (UK) Pre-12.2.15 Unauth HTTP RCE UK Payroll
CVE-2026-62560 Oracle HRMS (Norway) Internal Ops HTTP Remote Auth Bypass 12.2.3-12.2.15
CVE-2026-62561 Oracle HRMS (US) 12.2.3-12.2.15 Internal Ops Privilege Escalation
CVE-2026-62567 Oracle HRMS (UK) 12.2.3-12.2.15 Low Privilege HTTP Attack via UK Payroll
And others...

Oracle Scripting

CVE-2026-61263 Oracle E-Business Suite Scripting Admin (v12.2.312.2.15) Remote IDOR (CVE-2026-61263)

Oracle Supply Chain Globalization

CVE-2026-61266 Oracle EBS Copy Inv Org Vulnerability: Unauth Access & Partial DOS 12.2.3-12.2.15

Oracle Hcm Configuration Workbench

CVE-2026-61267 Oracle HCM Config Workbench <=12.2.15: Spreadsheet Loading unauth RCE

Oracle Product Hub

CVE-2026-61274 Oracle Product Hub Item Catalog RCE via HTTP (12.2.3-12.2.15)
CVE-2026-61275 Oracle Product Hub 12.2.3-12.2.15 RBS Privilege Escalation
CVE-2026-61311 Oracle EBS Product Hub Internal Ops CVE-2026-61311 (12.2.3-12.2.15) for HTTP
CVE-2026-61310 Oracle Product Hub Int Ops v12.2.-12.2.15: HTTP Low-Priv PWN CVE-2026-61310

Oracle Workflow

CVE-2026-61278 Oracle EBS Workflow NV Mailer RCE 12.2.312.2.15
CVE-2026-61247 Unauth Oracle Workflow Notification Mailer 12.2.312.2.15 Integrity Impact

Oracle Process Manufacturing Systems

CVE-2026-61285 Oracle Process Manufacturing Internal Ops 12.2.11-12.2.15 Vulnerability

Oracle U S Federal Financials

CVE-2026-61292 Oracle US Federal Financials 12.2.3-12.2.15 Internal Ops HTTP Read-Only

Oracle Common Applications Calendar

CVE-2026-61294 Oracle Common Apps Calendar: Calendar Sync Privilege Escalation 12.2.312.2.15

Oracle Telesales

CVE-2026-61322 Oracle EBS TeleSales Internal Ops Elev-priv HTTP RCE (12.2.3-12.2.15)

Oracle Price Protection

CVE-2026-61329 Oracle EBS 12.2.3-12.2.15 PriceProtection PrivEsc (CVE-2026-61329)
CVE-2026-61304 Oracle Price Protect. (EBS) Low-Priv HTTP Data Breach/DoS (12.2.312.2.15)

Oracle Product Workbench

CVE-2026-61333 Oracle PW Internal Ops CVE202661333 12.2.312.2.15
CVE-2026-61269 Oracle Product Workbench WebUI CVE-2026-61269: Unauth R/W/DoS Before 12.2.15

Oracle Human Resources

CVE-2026-62469 Oracle HR EBS 12.2.x EC Command Priv Escalation

Oracle Self Service Human Resources

CVE-2026-62470 Oracle EBS Self-Service HR v12.2.x Auth Bypass via HTTP
CVE-2026-61075 Oracle SSO HR Internal Ops <12.2.15: Unauth Read/Write via HTTP

Oracle Public Sector Payroll

CVE-2026-62476 Oracle Public Sector Payroll 12.2.3-12.2.15: Low-Privileged Remote HTTP Exploit

Oracle Public Sector Financials

CVE-2026-62478 Oracle Public Sector Financials (Int Ops) CVE-2026-62478 before 12.2.16
CVE-2026-62482 Oracle PSU Financials <=12.2.15 InternalOps low-priv HTTP flaw

Oracle Contracts Integration

CVE-2026-62486 Oracle Contracts Integration 12.2.3-12.2.15: Unauth HTTP Remote Update
CVE-2026-62488 Oracle Contracts Int. <12.2.15: Int Ops Low-Priv HTTP Write (CVE-2026-62488)

Oracle Time And Labor

CVE-2026-62494 Oracle Time & Labor 12.2.3-12.2.15; Internal Ops: Low-Priv HTTP RCE

Oracle Process Manufacturing Process Execution

CVE-2026-62495 HTTP Remote Takeover: Oracle Process Exec 12.2.15 Via Low Privilege

Oracle Yard Management

CVE-2026-62496 Oracle Yard Mngmt Remote Code Exec 12.2.6-12.2.15 HTTP

Oracle Process Manufacturing Regulatory Management

CVE-2026-62513 Oracle Process Manufacturing Reg. Mgmt v12.2.312.2.15 HTTP LowPriv Access

Oracle Succession Planning

CVE-2026-62519 Oracle EBS Succession Plan Vulnerability 12.2.3-12.2.15: Low-Privileged HTTP

Oracle Applications Framework

CVE-2026-62534 Oracle AF Web Utils 12.2.1112.2.15: Severe LPE HTTP

Oracle Access Manager

CVE-2026-61067 Oracle Access Manager Auth Engine Escalation 12.2.1.4.0-14.1.2.1.0

Oracle Peoplesoft Enterprise Fin Staffing Front Office Brazil

CVE-2026-61072 PeopleSoft FIN Staffing v9.1 Low-Priv Exploit (CVSS 9.9)

Oracle Public Sector Human Resources

CVE-2026-61080 Oracle PHR 12.2.3-12.2.15 HTTP Data Access via Regression Testing

Oracle Performance Management

CVE-2026-61083 Oracle EBS EPM Appraisals CVE-2026-61083 (12.2.3-12.2.15)

Oracle Goldengate

CVE-2026-61084 Oracle GoldenGate Libraries RCE 19.1-23.26.2

Oracle Communications Billing Revenue Management

CVE-2026-61091 Oracle Communications BRM Server LowPriv Exploit, v15.0.015.2
CVE-2026-61126 Low-privilege Local Hijack in Oracle Comm Billing & Rev Mgmt 15.x

Oracle Webcenter Enterprise Capture

CVE-2026-61099 Oracle WebCenter Capture Client Bundle CVE-2026-61099 12.2.1.4.0/14.1.2.0.0

Oracle Order Management

CVE-2026-61115 Oracle Order Mgmt Exploit via HTTP 12.2.3-12.2.15 Product Diagnostic Tools

Oracle Configure To Order

CVE-2026-61125 Oracle Configure to Order Vulnerability: STO Workbench 12.2.3-12.2.15

Oracle Commerce Platform

CVE-2026-61130 Oracle Commerce Platform 11.4.0: Unauth HTTP Crash via Dynamo AF CVE-2026-61130

Oracle Commerce Guided Search Platform Services

CVE-2026-61155 Oracle Commerce Guided Search v11.4.0 Forge HTTP Unauth DOS

Oracle Product Lifecycle Analytics

CVE-2026-61175 Oracle PL Analytics 3.6.1 HTTP Unauth Exploit (CVE-2026-61175)

Elasticsearch

CVE-2026-56144 Elasticsearch Ingest Simulation Auth Bypass (CWE-863)
CVE-2026-63136 Elasticsearch CVE-2026-63136: Uncontrolled Resource Consumption (CWE-400)
CVE-2026-63144 Elasticsearch Recursion DoS via Malicious Query (CVE-2026-63144)
CVE-2026-63263 Elasticsearch ES|QL CPU Exhaustion via Exponential Data Expansion
CVE-2026-63140 Elasticsearch DoS via Assertion Failure in Query Parsing
CVE-2026-56145 Elasticsearch Uncontrolled Resource Consumption via EQL Query

Elastic Kibana

CVE-2026-63139 Kibana Canvas Authenticated DoS via Uncontrolled Resource Consumption
CVE-2026-63143 Missing Auth in Kibana Unauthorized Data Disclosure
CVE-2026-63142 Kibana Reporting: Auth Bypass via Missing Disallowed Inputs (CWE-184)
CVE-2026-63260 Kibana Uncontrolled Resource Consumption via Oversized Payload DoS
CVE-2026-56147 Kibana Auth Bypass via UserControlled Key (CWE639)

Google

CVE-2026-15829 SQLi&Bypass in Google BigQuery Forecast Tool (bigquery-forecast)

Atlassian Confluence

CVE-2026-21579 Confluence DC Info Disclosure in 7.17.0-10.2.0

Canonical Ubuntu Linux

CVE-2026-15226 Snapd setuid Bypass via Snap-Confine Seccomp
CVE-2026-8933 CVE-2026-8933: Snap-confine Local Priv Escalation via set-capabilities

Aws Sdk Rust

CVE-2026-15957 SmithyRS Recursive Deserializer Causing DoS

Oracle Agile Product Lifecycle Management Process

CVE-2026-61183 Oracle Agile PXM (Process) v6.2.4 Reporting - Unauth HTTP Remote Code Exec
CVE-2026-61188 Oracle Agile PLM v6.2.4 Inst Remote Exploit

Oracle Peoplesoft Enterprise Scm Eprocurement

CVE-2026-61207 Oracle PeopleSoft SCM eProc 9.2 Manage Req Status Unauth RCE

Oracle Payroll

CVE-2026-61216 Oracle Payroll 12.2.3-12.2.15 Low-Pri Attacker Write-Read Partial DOS

Oracle E Business Suite Secure Enterprise Search

CVE-2026-61218 Low-Privilege HTTP Attack on Oracle SESE Search Integration Engine 12.2.3-12.2.15

Oracle Communications Converged Application Server

CVE-2026-61224 Oracle Communications Converged App Server 8.3 Sec Module Remote TLS PrivEsc

Oracle Peoplesoft Enterprise Fin Common Objects Brazil

CVE-2026-61232 PeopleSoft Common Objects 9.1 Unauth HTTP Remote Access (CVSS 7.5)

Oracle Advanced Inbound Telephony

CVE-2026-61256 Oracle Adv Inbound Tele 12.2.312.2.15 Servers: Low-Priv Remote HTTP Exploit

Oracle Isupport

CVE-2026-61257 Oracle iSupport 12.2.3-12.15 CallBack RCE CVE-2026-61257

Oracle Knowledge Management

CVE-2026-61261 Oracle Knowledge Management UI Low-Priv Data Manipulation (12.2.3-12.2.15)

Oracle Call Center Technology

CVE-2026-61264 Oracle Call Center Technology RDBMS/UI Access 12.2.3-12.2.15 CVE-2026-61264

Oracle Process Manufacturing Product Development

CVE-2026-61289 CVE-2026-61289: Oracle EBS Process Manufacturing 12.2.15 QMS HTTP RCE

Oracle Customers Online

CVE-2026-61297 Oracle EBS Customers Online Internal Ops: HTTP Low-Priv Exe 12.2.3-12.2.15

Oracle Edi Gateway

CVE-2026-61303 Oracle EDI Gateway 12.2.15 Unauth Read via Internal Ops (CVE202661303)
CVE-2026-61314 Oracle EDI Gateway 12.2.3-12.2.15 HTTP High Privilege Takeover CVE-2026-61314
CVE-2026-61316 Oracle EDI Gateway 12.2.3-12.2.15 Data Leak via HTTP