Archive
20 January 2026
Vulnerabilities first published on this day (UTC), newest first.
233 results · Feed
-
Medium 6.1
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Su…
-
Low 3.1
Vulnerability in Oracle Java SE (component: JavaFX). Supported versions that are affected are Oracle Java SE: 8u471-b50…
-
Medium 6.1
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte…
-
Medium 6.1
Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Scripting Admin). Supported versio…
-
High 7.5
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 6.5
Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: P…
-
Medium 5.0
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystems). Supported versions that are aff…
-
High 7.5
Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: User and User Group). The supported ve…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are a…
-
High 7.0
Vulnerability in the SQLcl component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.0…
-
Medium 6.1
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported vers…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are…
-
Medium 4.9
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affecte…
-
Medium 5.8
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Driver). The supported version that is affect…
-
Medium 5.4
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications). Su…
-
Medium 6.1
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
High 7.4
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 5.4
Vulnerability in the Oracle APEX Sample Applications product of Oracle APEX (component: Brookstrut Sample App). Support…
-
Medium 5.3
Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affe…
-
Low 2.3
Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Filesystems). The supported…
-
Medium 5.3
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affect…
-
Medium 4.8
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…
-
Medium 5.8
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Driver). The supported version that is affect…
-
High 7.5
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported v…
-
Medium 6.5
Vulnerability in the Oracle Life Sciences Central Designer product of Oracle Health Sciences Applications (component: P…
-
Medium 5.4
Vulnerability in the Oracle Utilities Application Framework product of Oracle Utilities Applications (component: Genera…
-
Medium 4.2
Vulnerability in the Oracle Planning and Budgeting Cloud Service product of Oracle Hyperion (component: EPM Agent). The…
-
Medium 6.0
Header injection in http.cookies.Morsel
When using http.cookies.Morsel, user-controlled cookie values and parameters can allow injecting HTTP headers into messages. Patch rejects all control characters within cookie names, values, and parameters.
-
Medium 5.9
POP3 command injection in user-controlled commands
The poplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
-
Medium 5.9
IMAP command injection in user-controlled commands
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing control characters.
-
Medium 6.9
Hard-Coded Default Credentials Enable Document Archive Decryption in Milner ImageDirector Capture
Use of Default Credentials, Hard-coded Credentials vulnerability in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows decryption of document archive files using credentials decrypted with hard-coded application encryption key. This issue…
-
High 7.2
Insecure Encryption Algorithms Enable Brute-Force Database Credential Access in Milner ImageDirector Capture
Use of a Broken or Risky Cryptographic Algorithm (DES) vulnerability in the Password class in C2SConnections.dll in Milner ImageDirector Capture on Windows allows Encryption Brute Forcing to obtain database credentials.This issue affects ImageDirector Capture…
-
High 8.5
Insufficient Configuration Protections Enable Database Credential Interception in Milner ImageDirector Capture
Insufficiently Protected Credentials, Improper Restriction of Communication Channel to Intended Endpoints vulnerability in the Connection Settings dialog in Milner ImageDirector Capture on Windows allows Adversary in the Middle (AiTM) by modifying the 'Server…
-
High 8.5
Insecure Masked Credential Fields Enable Database Credential Access in Milner ImageDirector Capture
Insufficiently Protected Credentials vulnerability in the Credential Field of Milner ImageDirector Capture allows retrieval of credential material and enables database access.This issue affects ImageDirector Capture: from 7.0.9 through 7.6.3.25808.
-
High 8.5
Hardcoded Encryption Key Enables Database Credential Access in Milner ImageDirector Capture
The use of a hard-coded encryption key in calls to the Password function in C2SGlobalSettings.dll in Milner ImageDirector Capture on Windows allows a local attacker to decrypt database credentials by reading the cryptographic key from the executable. This iss…
-
Medium 6.0
Header injection via newlines in data URL mediatype
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
-
Medium 5.9
wsgiref.headers.Headers allows header newline injection
User-controlled header names and values containing newlines can allow injecting HTTP headers.
-
Medium 5.7
Folding email comments of unfoldable characters doesn't preserve parenthesis
When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This could be used for injecting headers into email messages where addresses are user-controlled and not sanitized.
-
Medium 6.1
HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `c…
-
High 7.1
HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-del…