PT-2026-78170

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon version 4.5.0 Description A flaw in the Imperative Web Server component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to unauthorized read access to a...

PT-2026-77956

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 Description A flaw in the Installation and Configuration component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation...

PT-2026-77979

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw exists in the Content Acquisition System component. A low privileged attacker with network access via HTTP can exploit this issue to compromis...

PT-2026-77709

Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite component: Security API. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales Foundation...

PT-2026-77383

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM component: Marketing. Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attack...

PT-2026-78071

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM MCAD Connector version 3.6 Description A flaw in the CAX Client component allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system. Successful exploitation can lea...

PT-2026-77885

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Data Relationship Management version 11.2.25.0.000 Description A flaw in the Access and security component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead...

PT-2026-77924

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Financial Management version 11.2.25.0.000 Description A security flaw in the Security component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to...

PT-2026-78061

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM MCAD Connector version 3.6 Description A flaw in the CAX Client component of the Oracle Agile PLM MCAD Connector allows a low-privileged attacker with access to the execution infrastructure to compromise the system. This can...

PT-2026-77842

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Financial...

PT-2026-77886

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Data Relationship Management version 11.2.25.0.000 Description A flaw in the Access and security component allows a low privileged attacker with network access via SQL to compromise the system. This issue can lead to unauthoriz...

CVE-2026-54356 Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`

Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASIC role to supply attacker-controlled...

CVE-2026-64657 Budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET searchpath statement without escaping embedded double quotes, allowing an...

CVE-2026-63669

In ApostropheCMS before 4.32.0, the page module's move() skips the destination parent's _create permission check due to an archive-condition bug, allowing an authenticated editor or contributor to move a page into a restricted subtree and re-rank protected sibling pages via nudgeNewPeers() update...

CVE-2026-71479

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...

CVE-2026-71479 New API: Integer overflow in quota billing yields negative charges (self-crediting)

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...

CVE-2026-56686

Dell ObjectScale, versions prior to 4.3.0.1, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges...

CVE-2026-59909

Dell ObjectScale, versions prior to 4.3.0.1, contains a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering...

CVE-2026-59911

Dell ObjectScale, versions prior to 4.3.0.1, contains an Insertion of Sensitive Information into Log File vulnerability in the svctools. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2026-56089

Dell ObjectScale, versions prior to 4.3.0.1, contains a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...