CVE-2026-83145

Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM component: Order Management. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps -...

CVE-2026-83144

Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM component: Order Management. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps -...

CVE-2026-83116

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite component: Product Diagnostic Tools. Supported versions that are affected are 12.2.5-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order...

CVE-2026-18425

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action Concrete\Controller\Backend\Dashboard\SitemapUpdate using only the global accesssitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated...

EUVD-2026-79813

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite component: Enterprise Command Center. The supported version that is affected is V16. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management...

CVE-2026-87158

Oracle E-Business Suite – Order Management (Enterprise Command Center) in version V16 is affected by a network-based vulnerability exploitable via HTTP by a low-privileged attacker . The attack requires no user interaction and has low complexity , making it easily exploitable. Successful exploita...

CVE-2026-87157

A vulnerability in the Product Diagnostic Tools component of Oracle Order Management (Oracle E-Business Suite) affects supported versions 12.2.4 through 12.2.15 . A low-privileged attacker with network access via HTTP can exploit it with low complexity and no user interaction, resulting in high c...

EUVD-2026-79812

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite component: Product Diagnostic Tools. Supported versions that are affected are 12.2.4-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order...

CVE-2026-83145

Oracle Siebel CRM — Siebel Apps – Customer Order Management (Order Management component) in supported versions 17.0 through 26.7 is affected by a vulnerability that a low-privileged attacker with network access via HTTP can exploit with low complexity , though successful exploitation requires hum...

EUVD-2026-79471

Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM component: Order Management. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps -...

CVE-2026-83144

CVE-2026-83144 affects the Order Management component of Oracle Siebel CRM – Siebel Apps Customer Order Management , versions 17.0 through 26.7 . A low-privileged attacker with network access via HTTP can exploit this vulnerability, though successful exploitation requires user interaction from a ...

EUVD-2026-79472

Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM component: Order Management. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps -...

CVE-2026-83116

A vulnerability in Oracle Order Management (component: Product Diagnostic Tools ) within Oracle E-Business Suite , affecting supported versions 12.2.5 through 12.2.15 , allows a low-privileged attacker with network access via HTTP to compromise the product. The attack has a scope change , meaning...

EUVD-2026-79444

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite component: Product Diagnostic Tools. Supported versions that are affected are 12.2.5-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order...

EUVD-2026-79504

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action Concrete\Controller\Backend\Dashboard\SitemapUpdate using only the global accesssitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated...

CVE-2026-18425 IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action Concrete\Controller\Backend\Dashboard\SitemapUpdate using only the global accesssitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated...

CVE-2026-18425 IDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action Concrete\Controller\Backend\Dashboard\SitemapUpdate using only the global accesssitemap task permission and did not check per-page edit permission before updating each page's display order. As a result, an authenticated...

CVE-2026-18425

Concrete CMS 9 (versions 9.0.0 through 9.5.2) contains an IDOR flaw in the dashboard sitemap reorder action (SitemapUpdate::updateDisplayOrder). The controller checks only the global access_sitemap task permission and omits any per-page edit permission check, allowing an authenticated user with s...

CVE-2026-82190

Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who obtains the site's Joomla secret can compute a valid access token for any order on the site without ever having placed one, gaining guest access to that...

CVE-2026-82189

Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-service against the order pipeline: mass-failing pending orders to disrupt revenue and force manual reprocessing, or flipping already-fulfille...