8818 matches found
CVE-2026-61210: Improper Access Control
Vulnerability in the PeopleSoft Enterprise SCM Manufacturing product of Oracle PeopleSoft component: Security. The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise SCM...
CVE-2026-46943: Improper Access Control
Vulnerability in the Oracle Retail EFTLink product of Oracle Retail Applications component: Core/Plugin. Supported versions that are affected are 21.0.0-25.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Retail EFTLink...
CVE-2026-47005: Improper Access Control
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Self Update Framework. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise...
CVE-2026-46986: Improper Access Control
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Next Gen. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...
CVE-2026-46995: Improper Privilege Management
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Metadata Plugin. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle...
CVE-2026-46992: Missing Authentication for Critical Function
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Enterprise Config Management. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to...
CVE-2026-46987: Improper Access Control
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Application Service Level Mgmt. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to...
CVE-2026-60773: Improper Access Control
Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Core. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Application Object...
CVE-2026-60408: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in the TimesTen In-Memory Database product of Oracle TimesTen In-Memory Database component: Kubernetes Operator. The supported version that is affected is 26.1.1.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise TimesTen...
CVE-2026-60276: Missing Authentication for Critical Function
Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracl...
PT-2026-63113
Vulnerability in the PeopleSoft Enterprise FIN Manufacturing Brazil product of Oracle PeopleSoft component: Integration. The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterpris...
PT-2026-62615
Name of the Vulnerable Software and Affected Versions Oracle Partner Management versions 12.2.3 through 12.2.15 Description A flaw in the Partner Dashboard component allows a low privileged attacker with network access via HTTPS to compromise the system. This can lead to unauthorized read, update...
PT-2026-62719
Vulnerability in the Oracle U.S. Federal Financials product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle U.S...
OESA-2026-3063 coredns security update
CoreDNS is a fast and flexible DNS server. The key word here is flexible: with CoreDNS you are able to do what you want with your DNS data by utilizing plugins. Security Fixes: CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations gRPC, HTTP...
OESA-2026-3064 coredns security update
CoreDNS is a fast and flexible DNS server. The key word here is flexible: with CoreDNS you are able to do what you want with your DNS data by utilizing plugins. Security Fixes: CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations gRPC, HTTP...
CVE-2020-4450
creationtimestamp| type| source ---|---|--- 2026-07-18 15:00:05+00:00| seen| https://t.me/reverseame/153 2026-07-19 00:00:11+00:00| published-proof-of-concept| https://t.me/reverseame/153...
Metasploit Wrap Up: An HTTP to SMB relay plus Payload Improvements
Metasploit Wrap Up Housekeeping While the Metasploit Framework will be continuing its weekly release cadence, bringing you dear reader our latest content, the Weekly Wrap Up is being shifted to a bi-weekly cadence. The team is planning to use the additional time between posts to record demos of...
CVE-2026-48022: Cleartext Transmission of Sensitive Information
@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-origin redirect, but the origin check compares hostnames only and ignores scheme and port, so credentials are forwarded intact...
kumactl connects to control plane without verifying TLS certificate when no CA is configured
When an operator adds an HTTPS control plane profile to kumactl without providing a CA certificate, kumactl disables TLS verification and sends API tokens over the unverified connection Impact An attacker on the network path between the operator and the control plane can intercept user or admin A...