Oracle Retail Applications: Mehrere Schwachstellen
NEOSEC enrichment — no mirror of the original source
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Retail Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
Source: BSI CERT-Bund. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at BSI CERT-BundFull advisory
Mediumbsi:WID-SEC-2026-40834 linked CVEs
Open advisory with all CVEs
More on Applications
Other advisories
- CriticalCVE-2026-106074A flaw in Node.js `crypto` causes the internal entropy caches used by `crypto.randomUUID()`, `crypto.randomUUIDv7()`, and `crypto.randomInt()` to be saved into user-land startup snapshots (`--build-snapshot`) and single executable applications built with `useSnapshot`. If any of these functions, or an API that relies on them such as `URL.createObjectURL()`, is called while the snapshot is built, every process started from that snapshot returns the same values until the cache is refilled: up to 127 UUIDs and about 1,000 `randomInt()` values. Identifiers expected to be unique can collide across processes, and values issued by one process can be predicted by observing another. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.
- CriticalCVE-2026-105482A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
- Not ratedosv:CLEANSTART-2026-VV64101MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases
- Not ratedosv:CLEANSTART-2026-DR90917MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases
- Not ratedosv:CLEANSTART-2026-YJ93143MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases
- Not ratedosv:CLEANSTART-2026-OE47351In Reactor Core, applications that use the Flux
- Not ratedosv:CLEANSTART-2026-BH93909In Reactor Core, applications that use the Flux
- MediumCVE-2026-20218Multiple Cisco Products Snort 3 Visual Basic for Applications Buffer Overflow Denial of Service Vulnerability
Other news entries
- Node2Shell puts Microsoft and Node.js on Brotli patch dutyNewsCSO Online
- Protecting the vSphere Kubernetes Control Plane: Architecting Zero Trust for Supervisor and VKS with vDefendNewsVMware Security Advisories
- PHP Warns of Another Unpatched RCE Risk Two Days After Emergency PHP2Shell PatchesNewsThe Hacker News
- Oracle Financial Services Applications: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Oracle Utilities Applications: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Violations de données applicatives - Retour d’expérience du CERT-FR (20 octobre 2026)NewsCERT-FR (ANSSI)
- UK Legal Aid Agency Hack Scope Widens After Forensic ReviewNewsSecurityWeek
- Langflow's Critical Authenticated RCE Flaw Targeted in 1,423 Honeypot Exploit AttemptsNewsThe Hacker News
Source: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4083
ID