PT-2026-62472

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Service Delivery Platform Messaging Enabler version 12.2.1.4.0 Oracle Fusion Middleware Service Delivery Platform Messaging Enabler version 14.1.2.0.0 Description An unauthenticated attacker with network access via HTT...

PT-2026-62870

Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Publ...

PT-2026-63175

Name of the Vulnerable Software and Affected Versions Oracle Trade Management versions 12.2.3 through 12.2.15 Description An issue exists in the Claim LOV component of the Oracle Trade Management product within Oracle E-Business Suite. A low privileged attacker with network access via HTTP can...

PT-2026-62740

Name of the Vulnerable Software and Affected Versions Oracle Price Protection versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Price Protection product within Oracle E-Business Suite. A low privileged attacker with network access via...

PT-2026-62840

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Work in Process versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Work in Process product. An unauthenticated attacker with network access via HTTP can...

PT-2026-62251

Name of the Vulnerable Software and Affected Versions Oracle Hospitality Simphony versions 19.8 through 19.8.5 Oracle Hospitality Simphony versions 19.9 through 19.9.3 Oracle Hospitality Simphony version 19.10 Description An issue in the POS component allows an unauthenticated attacker with netwo...

PT-2026-62551

Name of the Vulnerable Software and Affected Versions Oracle JD Edwards EnterpriseOne Human Resources Management version 9.2 Description A flaw in the Human Resources component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead...

ROS-20260721-73-0017

The vulnerability of the Speech component in Google Chrome and Microsoft Edge is related to synchronization errors when using a common resource “Race Situation”. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created HT...

PT-2026-62779

Name of the Vulnerable Software and Affected Versions Oracle iReceivables versions 12.2.3 through 12.2.15 Description An issue exists in the AR Web Utilities component of the Oracle iReceivables product within Oracle E-Business Suite. An unauthenticated attacker with network access via HTTP can...

ROS-20260721-73-0046

The vulnerability of the user interfaces of Google Chrome and Microsoft Edge is related to insufficient validation of entered data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTML page...

ROS-20260721-73-0050

The vulnerability of the MHTML component in Google Chrome and Microsoft Edge is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially created HTML page...

PT-2026-63025

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Sites version 14.1.2.0.0 Description An issue in the Oracle WebCenter Sites component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitatio...

PT-2026-63072

Name of the Vulnerable Software and Affected Versions Oracle Agile Product Lifecycle Management for Process version 6.2.4 Description A flaw in the Installation component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a...

PT-2026-62142

Vulnerability in the Oracle Human Resources product of Oracle E-Business Suite component: Data Removal Tool. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Human Resources...

PT-2026-62682

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description An issue exists in the Web Content Management component of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP c...

PT-2026-62777

Name of the Vulnerable Software and Affected Versions Oracle iReceivables versions 12.2.3 through 12.2.15 Description A flaw in the AR Web Utilities component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a complete...

NPM: Axios: HTTP/2 streamed uploads bypass `maxBodyLength`

NPM: Axios: HTTP/2 streamed uploads bypass maxBodyLength vulnerability discovered by ? in WordPress Npm axios versions = 1.13.0, 1.18.0...

Mistune: XSS via unescaped class option in Admonition directive

In src/mistune/directives/admonition.py, the renderadmonition function concatenates the :class: option directly into the HTML class attribute without escaping lines 63-68. This allows attribute injection and XSS even when HTMLRendererescape=True is used. The directive name parameter is safe...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

EUVD-2026-45972

Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the Mailpit SMTP server has a Server.MaxSize int field that controls the maximum allowed DATA payload size, but the field is never assigned anywhere outside test code, leaving it at Go's zero value 0 ⇒ "no limit". T...