CVE-2026-27471 ERP: Document access through endpoints due to missing validation

ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access validation which allowed for unauthorized document access. This issue has been fixed in versions 15.98.1 and 16.6.1...

PT-2026-21352

A security vulnerability has been detected in feng ha ha/megagao ssm-erp and production ssm up to 4288d53bd35757b27f2d070057aefb2c07bdd097. Impacted is an unknown function of the file EmployeeController.java. The manipulation leads to improper authorization. It is possible to initiate the attack...

PT-2026-21361

Name of the Vulnerable Software and Affected Versions ERP versions up to 15.98.0 ERP versions 16.0.0-rc.1 through 16.6.0 Description Certain API endpoints in ERP lacked proper access validation, potentially allowing unauthorized access to documents. The issue affects versions up to 15.98.0 and...

MeCODE Envanty 安全漏洞

MeCODE Envanty is an enterprise resource planning management system developed by the Turkish company MeCODE. Versions of MeCODE Envanty prior to 1.0.6 contained security vulnerabilities. These vulnerabilities stemmed from unauthorized access through user-controlled keys, which could lead to...

In-Context Autonomous Network Incident Response: An End-To-End Large Language Model Agent Approach

Rapidly evolving cyberattacks demand incident response systems that can autonomously learn and adapt to changing threats. Prior work has extensively explored the reinforcement learning approach, which involves learning response strategies through extensive simulation of the incident. While this...

Security Bulletin: Multiple vulnerabilities in IBM Planning Analytics

Summary Multiple vulnerabilities were addressed in IBM Planning Analytics Local. Vulnerability Details CVEID:CVE-2025-53057 DESCRIPTION: An unspecified vulnerability in Java SE related to the Security component could allow a remote attacker to cause no confidentiality impact, high integrity impac...

CVE-2025-8025 Improper Access Control in Dinosoft Business Solutions' Dinosoft ERP

Missing Authentication for Critical Function, Improper Access Control vulnerability in Dinosoft Business Solutions Dinosoft ERP allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Dinosoft ERP: from 3.0.1 through 11022026. NOTE: The vendor was contacted early about...

Dinosoft ERP 访问控制错误漏洞

Dinosoft ERP is an enterprise resource planning platform developed by the Turkish company Dinosoft. Versions of Dinosoft ERP from 3.0.1 up to 11022026 contained a security vulnerability related to access control. This vulnerability stemmed from the lack of authentication for critical functions an...

Optimizing Agent Planning for Security and Autonomy

Indirect prompt injection attacks threaten AI agents that execute consequential actions, motivating deterministic system-level defenses. Such defenses can provably block unsafe actions by enforcing confidentiality and integrity policies, but currently appear costly: they reduce task completion...

CVE-2026-23681

Due to missing authorization check in a function module in SAP Support Tools Plug-In, an authenticated attacker could invoke specific function modules to retrieve information about the system and its configuration. This disclosure of the system information could assist the attacker to plan...

SAP CRM和SAP S/4HANA 安全漏洞

SAP CRM and SAP S/4HANA are both products of the German company SAP. SAP CRM is a customer relationship management system. SAP S/4HANA is an enterprise resource management software based on the SAP HANA in-memory database system. There are security vulnerabilities in SAP CRM and SAP S/4HANA. Thes...

MongoDB Server -- Multiple vulnerabilities

https://jira.mongodb.org/browse/SERVER-114126 reports: Complex queries can cause excessive memory usage in MongoDB Query Planner resulting in an Out-Of-Memory Crash. https://jira.mongodb.org/browse/SERVER-102364 reports: MongoDB Server may experience an out-of-memory failure while evaluating...

[SECURITY] Fedora 43 Update: plantuml-1.2026.1-1.fc43

PlantUML is a program allowing to draw UML diagrams, using a simple and human readable text description. It is extremely useful for code documenting, sketching project architecture during team conversations and so on. PlantUML supports the following diagram types - sequence diagram - use case...

Hallucination-Resistant Security Planning with a Large Language Model

Large language models LLMs are promising tools for supporting security management tasks, such as incident response planning. However, their unreliability and tendency to hallucinate remain significant challenges. In this paper, we address these challenges by introducing a principled framework for...

CVE-2020-37090

School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system. Attackers can upload malicious PHP scripts through the message attachment feature, enabling remote code execution on the server...

CVE-2020-37088 School ERP Pro 1.0 - Arbitrary File Read

School ERP Pro 1.0 contains a file disclosure vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the 'document' parameter in download.php. Attackers can access sensitive configuration files by supplying directory traversal paths to retrieve system...

PT-2026-4714

In multiple functions of ubsan throwing runtime.cpp, there is a possible persistent denial of service due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-21979

Vulnerability in the Oracle Planning and Budgeting Cloud Service product of Oracle Hyperion component: EPM Agent. The supported version that is affected is 25.04.07. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Planning and Budgeti...

CVE-2026-21922

Vulnerability in the Oracle Planning and Budgeting Cloud Service product of Oracle Hyperion component: EPM Agent. The supported version that is affected is 25.04.07. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Planning and Budgeti...

EUVD-2026-3533

Vulnerability in the Oracle Planning and Budgeting Cloud Service product of Oracle Hyperion component: EPM Agent. The supported version that is affected is 25.04.07. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Planning and Budgeti...