7841 matches found
PT-2026-77437
Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description An issue exists in the Content Server component of Oracle WebCenter Content. An unauthenticated attacker with access to the physical...
PT-2026-77963
Name of the Vulnerable Software and Affected Versions Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 Description A flaw in the Installation and Configuration component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation...
PT-2026-77225
Name of the Vulnerable Software and Affected Versions Submariner operator affected versions not specified Description A flaw exists in the Submariner operator where the Submariner Custom Resource CR, used for network connectivity configuration, stores the IPsec pre-shared key PSK in an unencrypte...
PT-2026-78162
Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon version 3.2.18 Description A flaw in the Imperative Web Server component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorized...
PT-2026-78155
Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon versions 4.0.0 through 4.5.0 Description A flaw in the Imperative Web Server component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead ...
PT-2026-78097
Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon version 4.5.0 Description A flaw in the Imperative Web Server component allows a low privileged attacker with network access via HTTPS to compromise the system. Successful exploitation can lead to unauthorized...
PT-2026-78126
Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.14 Description A flaw in the Core component allows a high privileged attacker with access to the infrastructure where the software executes to compromise the system. This can lead to unauthorized read access to...
CVE-2026-72089
A flaw was found in the Linux kernel's Intel Versatile Processing Unit IVPU accelerator driver. An attacker could exploit a vulnerability in how the driver handles firmware logs with incorrect size information. This could lead to an out-of-bounds read, potentially disclosing sensitive information...
CVE-2026-17087 WP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-12998 Forminator Forms <= 1.55.0.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'draft' Parameter
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.55.0.2 via the 'draft' parameter due to missing validation on a user controlled key. This makes it possible for...
CVE-2026-16611
The Product Feed PRO for WooCommerce by AdTribes WordPress plugin before 13.5.7 does not perform an authorization check on one of its REST read routes, allowing unauthenticated users to disclose a store's feed configuration rules, filters and field mapping and to enumerate the full product catego...
CVE-2026-16541 Simply Schedule Appointments < 1.6.12.17 - Team Member+ User Email Disclosure via Users and Customers REST Endpoints
The Simply Schedule Appointments WordPress plugin before 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see, allowing users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered...
EUVD-2026-58823
A flaw was found in Red Hat Quay. A user with FEATUREBUILDSUPPORT enabled and repository write access can exploit a Server-Side Request Forgery SSRF vulnerability within the build API. This allows the user to provide a malicious URL, causing the Quay builder to make requests to internal network...
WordPress Amelia plugin < 2.4.6 - Provider+ Cross-Customer Appointment Data Disclosure via IDOR vulnerability
Provider+ Cross-Customer Appointment Data Disclosure via IDOR vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin Amelia versions 2.4.6...
WordPress WP Helper Premium plugin < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation vulnerability
Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation vulnerability discovered by Farid Narimanov in WordPress Plugin WP Helper Premium versions 4.7.6...
WordPress Order Sync with Zendesk for WooCommerce plugin < 2.2.3 - Unauthenticated Customer Order Data Disclosure vulnerability
Unauthenticated Customer Order Data Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Order Sync with Zendesk for WooCommerce versions 2.2.3...
PT-2026-72132
Name of the Vulnerable Software and Affected Versions Red Hat Quay affected versions not specified Description A Server-Side Request Forgery SSRF flaw exists within the build API. A user with repository write access and the FEATURE BUILD SUPPORT enabled can provide a malicious URL via the archive...
EUVD-2026-58288
Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that...
CVE-2026-72672 Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data
The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the...