PT-2026-62701

Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Switzerland product of Oracle PeopleSoft component: Global Payroll for Switzerland. The supported version that is affected is 9.2. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to...

PT-2026-62633

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft Enterprise FIN Pay/Bill Management version 9.2 Description A flaw in the Paybill Management component allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system. Th...

PT-2026-62974

Vulnerability in the PeopleSoft Enterprise SCM Order Management product of Oracle PeopleSoft component: Security. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise PeopleSoft Enterprise SCM...

PT-2026-63087

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft Enterprise SCM eProcurement version 9.2 Description An issue exists in the Manage Requisition Status component that allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful...

PT-2026-62548

Name of the Vulnerable Software and Affected Versions Oracle JD Edwards EnterpriseOne CRM Foundation version 9.2 Description A flaw in the CRM Foundation component allows a low-privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a complet...

PT-2026-62766

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Applications Framework versions 12.2.3 through 12.2.15 Description A flaw in the Graph / Charting component of the Oracle Applications Framework allows a low privileged attacker with network access via HTTP to...

EUVD-2026-45893

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the...

MiracleLinux 9 : redis-6.2.22-1.el9_8 (AXSA:2026-1300:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1300:02 advisory. redis: RESTORE invalid memory access may allow remote code execution CVE-2026-25243 Tenable has extracted the preceding description block directly from the...

CVE-2026-53727

cssparser is a Ruby CSS parser. From 2.2.0 until 3.0.0, CssParser::Parserreadremotefile in lib/cssparser/parser.rb, and therefore loaduri! and the @import-following branch of addblock!, issued HTTP and HTTPS requests against any host, port, and URI without a scheme allowlist, host or IP filtering...

WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by HieuPenguinnn in WordPress Plugin WPDM – Premium Packages versions = 6.2.0...

CVE-2026-13005

The CVE concerns the MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress. Affected: all versions up to 3.2.10. Vulnerability: Stored Cross-Site Scripting via the intro_message admin setting due to insufficient input sanitization and output escaping. Privileged context: aut...

JLSEC-2026-761

iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of message...

CVE-2026-58077 Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2

Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS. A specially crafted unauthenticated request may result in website takeover under some circumstances...

UBUNTU-CVE-2026-47737

Puma is a Ruby/Rack web server built for parallelism. From 5.5.0 until 7.2.1 and 8.0.2, Puma is vulnerable to source IP spoofing when setremoteaddress proxyprotocol: :v1 is enabled and persistent connections are used because Puma incorrectly re-parses PROXY protocol headers after each keep-alive...

CVE-2026-15698 kofrasa mingo Update API updateMany prototype pollution

A vulnerability was determined in kofrasa mingo up to 7.2.1. This impacts the function update/updateOne/updateMany of the component Update API. Executing a manipulation of the argument Set can lead to improperly controlled modification of object prototype attributes. The attack may be launched...

CVE-2026-15669 louisho5 picobot exec Tool exec.go ExecTool.Execute os command injection

A vulnerability was found in louisho5 picobot up to 0.2.0. This issue affects the function ExecTool.Execute of the file internal/agent/tools/exec.go of the component exec Tool. The manipulation results in os command injection. The attack requires a local approach. The exploit has been made public...

CVE-2026-15668 louisho5 picobot web Tool web.go WebTool.Execute server-side request forgery

A vulnerability has been found in louisho5 picobot up to 0.2.0. This vulnerability affects the function WebTool.Execute of the file internal/agent/tools/web.go of the component web Tool. The manipulation of the argument url leads to server-side request forgery. The attack can be initiated remotel...

Open Babel has out-of-bounds write in ORCA nAtoms parser

SummaryA memory-safety vulnerability in Open Babel's ORCA parser allowed anout-of-bounds write when reading a crafted input file. DetailsThe flaw was in the nAtoms handling of the ORCA reader. A malformedinput caused the parser to write past the end of its destinationbuffer. ImpactOpen Babel is a...

CVE-2026-59518

Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through = 8.8.2...

CVE-2026-59518 WordPress Directorist plugin <= 8.8.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injection.This issue affects Directorist: from n/a through = 8.8.2...