EUVD-2026-46182

The Grav api plugin grav-plugin-api before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission the baseline...

CVE-2026-64627 Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Coercion

Parse Server versions = 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled graphQLPublicIntrospection: false, the default, schema-derived 'Did you mean ...?' suggestions were still...

BIT-ARGO-CD-2026-45738 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/ annotations whose pipe-separated values are rendered by...

CVE-2026-15690

A flaw was found in open62541, a widely used open-source OPC UA Open Platform Communications Unified Architecture toolkit. A remote attacker could trigger a denial of service by sending a specially crafted request that manipulates a specific argument within the Shared Client Library. This...

PT-2026-63002

Name of the Vulnerable Software and Affected Versions Oracle Application Object Library versions 12.2.3 through 12.2.15 Description An issue exists within the DB Privileges component of the Oracle Application Object Library. A low privileged attacker with network access via HTTP can compromise th...

PT-2026-62236

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Application Object Library versions 12.2.3 through 12.2.15 Description A flaw in the Core component of the Oracle Application Object Library allows a low privileged attacker with network access via HTTP to...

PT-2026-63047

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with logon to the...

PT-2026-62966

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft component: Common Application Objects. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

PT-2026-61958

HCL IEM was affected with the Anti Clickjacking XFrame Options Header Missing. It may allow attackers to embed the application in malicious pages and induce unauthorized user actions...

PT-2026-62773

Name of the Vulnerable Software and Affected Versions Oracle Application Object Library versions 12.2.3 through 12.2.15 Description An issue exists in the AOL Generic Loader component of the Oracle Application Object Library product of Oracle E-Business Suite. A high privileged attacker with acce...

PT-2026-62137

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result i...

CVE-2026-46924: Improper Access Control

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can result i...

PT-2026-63004

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Application Object Library versions 12.2.3 through 12.2.15 Description An issue in the Core component of the Oracle Application Object Library allows an unauthenticated attacker with network access via HTTP to...

CVE-2026-61226: Improper Access Control

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications component: RTP Proxy. The supported version that is affected is 8.3. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle...

CVE-2026-65317: Server-Side Request Forgery (SSRF)

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...

PT-2026-62134

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise Oracle Application Testing Suite. Successful attacks of this vulnerability can...

CVE-2025-66390

In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...

PT-2026-62644

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft Enterprise CC Common Application Objects version 9.2 Description An issue in the Common Application Objects component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful...

PT-2026-63098

Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications component: Security. The supported version that is affected is 8.3. Difficult to exploit vulnerability allows high privileged attacker with network access via TLS to compromise Oracle...

PT-2026-63017

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce component: Dynamo Application Framework. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform...