PT-2026-92615

Name of the Vulnerable Software and Affected Versions Oracle Field Service versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Field Service product within Oracle E-Business Suite. A low privileged attacker with network access via HTTP ca...

PT-2026-92447

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Orchestrator affected versions not specified Description A flaw in the API endpoint allows a low-privilege authenticated remote attacker to escalate privileges. This could lead to the execution of arbitrary...

PT-2026-92689

Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite component: Outcome-Result. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Custome...

PT-2026-93082

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain component: Engineering Communication Interface. The supported version that is affected is 6.2.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Orac...

PT-2026-92867

Name of the Vulnerable Software and Affected Versions Oracle XML Gateway versions 12.2.3 through 12.2.15 Description A flaw in the Install component of the Oracle XML Gateway product of Oracle E-Business Suite allows a low privileged attacker with network access via HTTP to compromise the system...

CVE-2026-90933 laradashboard through 1.2.2 Missing Authorization via License API

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST...

CVE-2026-79987 Low-privilege RCE through element-search eager loading

A remote, authenticated, non-admin Craft CMS Control Panel user with only the accessCp permission can execute operating system commands as the PHP web worker...

PT-2026-89164

In RuoYi-Cloud-Plus = 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the Service layer does not verify whether the current user is the task handler/related user. Authenticated low-privileged remote attackers can read sensitive...

Kibana 8.x < 8.19.21 / 9.0.3 < 9.4.6 Missing Authorization (ESA-2026-155)

The version of Kibana installed on the remote host is 8.x prior to 8.19.21, or 9.0.3 prior to 9.4.6. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-155 advisory. - Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential...

EUVD-2026-72676

It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content elements that fall outside of their permitted range. Exploiting...

CVE-2026-75165

An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware V60005 allows a remote authenticated user with the low-privileged Standard role to invoke hidden network diagnostic methods ugw-ping, ugw-traceroute that are not exposed in the web UI, allowing attackers to obtain sensitive...

CVE-2026-85226

MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restrictions associated with the correlated attributes and events...

terrapod-PoC

Terrapod: security advisory CVE status: requested, pend...

CVE-2026-78586 Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service

Allocation of Resources Without Limits or Throttling CWE-770 in Kibana can lead to a denial of service via Excessive Allocation CAPEC-130. An authenticated user with low-level privileges could submit a specially crafted request that causes Kibana to consume an unbounded amount of memory, renderin...

CVE-2026-78597

Missing Authorization CWE-862 in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user holding only low-privilege Security feature access could invoke an administrative operation tha...

CVE-2026-73732

A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access to obtain sensitive information. Successful exploitation could allow an attacker to retrieve sensitive data which could be used to gain...

CVE-2026-73733

Authentication bypasses in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to circumvent existing authentication controls. Successful exploitation could allow an attacker to retain limited access to the affected system after that access should ha...

CVE-2026-73729

A vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low privilege operator user with local access to upstream AFC dependencies to view sensitive information. Successful exploitation could allow an attacker to access data beyond what is...

EUVD-2026-69471

A denial-of-service vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an authenticated low privilege operator user to cause a denial of service. Successful exploitation could allow an attacker to disrupt the availability of the affected...

CVE-2026-73742 Improper Client Address Validation allows Request Attribution Spoofing in Fabric Composer API Endpoint

A vulnerability in an API endpoint of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to spoof the source address attributed to their requests. Successful exploitation could allow an attacker to cause inaccurate attribution information to be recorded on the...