Search: “middleware”

45 stories

Oracle's September 2026 CPU ships 673 patches including six CVSS 10.0 flaws in Fusion Middleware and Hyperion, none exploited in the wild.

Oracle's September 2026 Critical Security Patch Update delivers 673 patches across 17 product families, led by E-Business Suite with 159 fixes and Fusion Middleware with 153. Six CVSS 10.0 vulnerabilities in Access Manager, Forms, Internet Directory, Platform Security for Java, WebLogic Server, and Hyperion are remotely exploitable without authentication, and Oracle reports none exploited in the wild. Now patching monthly, Oracle urged immediate deployment and warned that unsupported releases are not tested for these flaws.

CSO OnlineSep 16, 15:54 UTC · 15h agoVulnerability CVE-2026-71133 CVE-2026-83099 CVE-2026-83059+16 CVEs

Attackers can bypass middleware auth checks by exploiting critical Next.js flaw

Security AffairsMar 24, 11:22 UTC · Mar 24, 2025Vulnerability CVE-2025-29927

Critical Next.js auth bypass vulnerability opens web apps to compromise (CVE-2025-29927)

Help Net SecurityApr 2, 08:44 UTC · Apr 2, 2025Vulnerability in the wildCVE-2025-29927

Critical Next.js Vulnerability Allows Attackers to Bypass Middleware Authorization Checks

The Hacker NewsMar 25, 03:16 UTC · Mar 25, 2025Vulnerability CVE-2025-29927

NCSC Urges Users to Patch Next.js Flaw Immediately

Infosecurity MagazineMar 31, 10:15 UTC · Mar 31, 2025Vulnerability CVE-2025-29927

CISA Warns of Actively Exploited Critical Oracle Fusion Middleware Vulnerability

The Hacker NewsNov 29, 08:07 UTC · Nov 29, 2022Vulnerability in the wildCVE-2021-35587 CVE-2022-4135

Researchers raise alarm about critical Next.js vulnerability

CyberScoopMar 24, 21:26 UTC · Mar 24, 2025Vulnerability CVE-2025-29927

Actively exploited critical flaw in Modular DS WordPress plugin enables admin takeover

Security AffairsJan 16, 08:26 UTC · Jan 16, 2026Vulnerability in the wildCVE-2026-23550

CISA Warns of Sitecore RCE Flaws; Active Exploits Hit Next.js and DrayTek Devices

The Hacker NewsMar 29, 03:45 UTC · Mar 29, 2025Vulnerability in the wildCVE-2019-9874 CVE-2019-9875 CVE-2020-8515+2 CVEs

Next.js Patches Critical AVIF and Windows Flaws Enabling Unauthenticated RCE

Vercel patches two critical Next.js unauthenticated RCE flaws: a libheif AVIF heap overflow (CVSS 9.5) and a Windows path traversal (CVE-2026-75604).

Vercel patched two critical Next.js flaws enabling unauthenticated remote code execution: a heap buffer overflow in libheif's AVIF image scaling (GHSA-2xp9-vwfh-vxw4, CVSS v4 9.5) and a Windows path traversal (CVE-2026-75604, CVSS 9.0). The AVIF flaw affects only sites explicitly enabling AVIF optimization and overwrites roughly 16,384 bytes past the buffer; the path traversal affects Windows-hosted Next.js deployments on versions 13.4-15.5.23 and 16.0-16.3.2. Fixes shipped in Next.js 15.5.24 and 16.3.3 on August 25, 2026, with the AVIF researchers releasing a Python PoC demonstrating RCE on multiple applications. No exploitation had been reported as of August 27, 2026.

The Hacker NewsAug 27, 15:16 UTC · 20d agoVulnerability CVE-2026-75604

CVE-2026-33032: severe nginx-ui bug grants unauthenticated server access

Security AffairsApr 15, 18:17 UTC · Apr 15, 2026Vulnerability in the wildCVE-2026-33032

Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover

The Hacker NewsApr 15, 00:00 UTC · Apr 15, 2026Vulnerability in the wildCVE-2026-33032 CVE-2026-27944 CVE-2026-27825+1 CVEs

Oracle issues an emergency patch for a bug in Oracle Identity Manager, apply it now!

Security AffairsNov 1, 10:07 UTC · Nov 1, 2017Vulnerability CVE-2017-10151

Highly Critical Flaw (CVSS Score 10) Lets Hackers Hijack Oracle Identity Manager

The Hacker NewsOct 31, 08:01 UTC · Oct 31, 2017Vulnerability CVE-2017-10151

Oracle releases emergency Oracle Identity Manager patch

Help Net SecurityOct 31, 00:00 UTC · Oct 31, 2017Vulnerability in the wildCVE-2017-10151

Veeam, Terraform MCP, Django Patch Critical Flaws, Led by CVSS 10.0 Cross

The Hacker NewsAug 5, 14:27 UTC · Aug 5, 2026Vulnerability in the wildCVE-2026-58073 CVE-2026-58072 CVE-2026-58067+10 CVEs1

Critical Fortinet FortiClient EMS bug under active attack (CVE-2026-21643)

Help Net SecurityJun 24, 10:29 UTC · Jun 24, 2026Vulnerability in the wildCVE-2026-21643

⚡ Weekly Recap: Fiber Optic Spying, Windows Rootkit, AI Vulnerability Hunting and More

The Hacker NewsApr 15, 00:00 UTC · Apr 15, 2026Vulnerability in the wildCVE-2026-346212

Oracle issues emergency fix for pre-auth RCE in Identity Manager (CVE-2026-21992)

Help Net SecurityMar 23, 00:00 UTC · Mar 23, 2026Vulnerability in the wildCVE-2026-21992 CVE-2025-61757

Oracle fixes critical RCE flaw CVE-2026

Security AffairsMar 22, 15:37 UTC · Mar 22, 2026Vulnerability in the wildCVE-2026-21992 CVE-2025-61757

CISA Urges Patch of Actively Exploited Flaw in Oracle Identity Manager

Infosecurity MagazineNov 24, 11:07 UTC · Nov 24, 2025Vulnerability in the wildCVE-2025-61757 CVE-2021-35587

Hackers deploy DripDropper via Apache ActiveMQ flaw, patch systems to evade detection

Security AffairsAug 21, 16:30 UTC · Aug 21, 2025Vulnerability in the wildCVE-2023-46604

Oracle To Address 320 Vulnerabilities in January Patch Update

Infosecurity MagazineJan 21, 12:45 UTC · Jan 21, 2025Vulnerability in the wildCVE-2020-2883

Critical RCE Vulnerability Discovered in Ollama AI Infrastructure Tool

The Hacker NewsJun 25, 03:22 UTC · Jun 25, 2024Vulnerability CVE-2024-37032 CVE-2024-22476

8220 gang exploits old Oracle WebLogic vulnerability to deliver infostealers, cryptominers

Help Net SecurityDec 20, 00:00 UTC · Dec 20, 2023Vulnerability CVE-2020-14883 CVE-2017-3506 CVE-2020-14882

July 2020 Patch Tuesday: Microsoft plugs wormable Windows DNS Server RCE flaw

Help Net SecurityNov 14, 09:19 UTC · Nov 14, 2023Vulnerability in the wildCVE-2020-1350 CVE-2020-1147 CVE-2020-1349+2 CVEs

Muhstik Botnet Targeting Redis Servers Using Recently Disclosed Vulnerability

The Hacker NewsMar 28, 06:59 UTC · Mar 28, 2022Vulnerability in the wildCVE-2022-0543 CVE-2017-10271 CVE-2018-7600+3 CVEs

Easily exploitable RCE in Oracle WebLogic Server under attack (CVE-2020-14882)

Help Net SecurityNov 3, 08:52 UTC · Nov 3, 2020Vulnerability CVE-2020-14882 CVE-2020-14750

Two Critical Remote Code Execution flaws fixed in IBM WebSphere

Security AffairsJun 9, 14:29 UTC · Jun 9, 2020Vulnerability CVE-2020-4450 CVE-2020-4448 CVE-2020-4449

Oracle fixes 252 vulnerabilities in October 2017 Critical Patch Update

Help Net SecurityMay 28, 10:21 UTC · May 28, 2020Vulnerability CVE-2017-10402 CVE-2017-10405 CVE-2017-10404

Oracle fixes Solaris 10 flaw targeted by leaked NSA exploit

Help Net SecurityMay 28, 10:21 UTC · May 28, 2020Vulnerability CVE-2017-3623 CVE-2017-3622 CVE-2017-5638

Another Oracle WebLogic Server RCE under active exploitation

Help Net SecurityJun 19, 00:00 UTC · Jun 19, 2019Vulnerability in the wildCVE-2019-2729 CVE-2019-2725

Oracle critical patch advisory addresses 284 flaws, 33 critical

Security AffairsJan 18, 13:15 UTC · Jan 18, 2019Vulnerability CVE-2016-1000031 CVE-2017-5645 CVE-2018-11776+3 CVEs

Post-pumpkin Patch Tuesday: What's in store for November

Help Net SecurityOct 15, 09:22 UTC · Oct 15, 2018Vulnerability CVE-2016-7855

CVE-2018-2879 - Vulnerability in Oracle Access Manager can let attackers impersonate any user account

Security AffairsMay 3, 13:46 UTC · May 3, 2018Vulnerability CVE-2018-2879

Faulty Patch for Oracle WebLogic Flaw Opens Updated Servers to Hackers Again

The Hacker NewsApr 30, 13:39 UTC · Apr 30, 2018Vulnerability CVE-2018-2628

Oracle botches CVE-2018-2628 patch and hackers promptly start scanning for vulnerable WebLogic installs

Security AffairsApr 30, 10:05 UTC · Apr 30, 2018Vulnerability CVE-2018-2628