PT-2026-62615

Name of the Vulnerable Software and Affected Versions Oracle Partner Management versions 12.2.3 through 12.2.15 Description A flaw in the Partner Dashboard component allows a low privileged attacker with network access via HTTPS to compromise the system. This can lead to unauthorized read, update...

PT-2026-62438

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle HRMS France versions 12.2.3 through 12.2.15 Description A flaw in the French HR Payroll component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to...

PT-2026-63266

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Uncontrolled Resource Consumption in Kibana can lead to a denial of service through excessive allocation. A low-privileged authenticated user can send a specially crafted request to a machine...

PT-2026-62278

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.4.0 Oracle WebLogic Server versions 14.1.2.0.0 Description An access control flaw exists in the Core component of the Oracle WebLogic Server. A high-privileged attacker with access to the physical...

PT-2026-62742

Name of the Vulnerable Software and Affected Versions MySQL Server versions 9.7.0 through 9.7.1 MySQL Cluster versions 9.7.0 through 9.7.1 Description A flaw exists in the Server: JSON component. A low privileged attacker with network access via multiple protocols can exploit this issue to cause ...

PT-2026-62434

Name of the Vulnerable Software and Affected Versions Oracle Project Manufacturing version V16 Description A flaw in the PJM Command Center component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can result in unauthorized read...

PT-2026-62697

Vulnerability in the Oracle Solaris product of Oracle Systems component: Filesystems. The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris...

PT-2026-62562

Name of the Vulnerable Software and Affected Versions Oracle Unified Directory versions 12.2.1.4.0 Oracle Unified Directory versions 14.1.2.1.0 Description A flaw in the OUD Core component of Oracle Fusion Middleware allows a low privileged attacker with network access via LDAP to compromise the...

PT-2026-63066

Name of the Vulnerable Software and Affected Versions Oracle Agile Product Lifecycle Management for Process version 6.2.4 Description A flaw exists in the Data Import component of the Oracle Agile Product Lifecycle Management for Process product. A high privileged attacker with access to the...

PT-2026-63154

Name of the Vulnerable Software and Affected Versions Oracle Product Hub versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a full...

CVE-2026-57495

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71, two inbound-mail handlers act on a...

CVE-2026-55550

NextCRM is affected by an RBAC bypass in the MCP product tools. In version 0.12.1, write operations for the product catalog were exposed via /api/mcp/mcp using user-generated Bearer tokens without proper role checks, allowing any authenticated low-privileged user to create, modify, archive, or so...

CVE-2026-44231

CVE-2026-44231 affects RT REST 2.0: a privileged (non-administrative) user can obtain authentication credentials belonging to other users (including admins) and use them to read data via RT’s feed endpoints. The same request that exposes credentials also rotates them, invalidating existing feed U...

CVE-2026-8170

The mv, cp, and rm file utilities exposed within the ExtremeXOS EXOS shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. An attacker with low-privilege CLI access can create a symbolic link that references a privileged filesyst...

CVE-2026-8170

The affected component is the mv, cp, and rm utilities in the ExtremeXOS (EXOS) shell. The vulnerability stems from unsafe path canonicalization and following symbolic links outside the intended privilege boundary, allowing a low-privilege attacker to reference privileged filesystem locations. An...

CVE-2026-8169

ExtremeXOS EXOS uses a challenge-response mechanism to authorize access to the privileged debug-mode function. The challenge value is generated using an insufficiently random source, which under certain conditions may allow an attacker to predict the expected response and activate debug-mode...

CVE-2026-28220

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API DAPI handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the maste...

EUVD-2026-45978

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API DAPI handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the maste...

CVE-2026-28220

CVE-2026-28220 concerns the Wazuh Cluster Distributed API (DAPI). Before version 4.14.5, the master node could be coerced to deserialize an attacker-controlled callable and run it under an attacker-controlled RBAC context due to a permissive as_wazuh_object() deserialization and client-supplied r...

CVE-2026-28220 Wazuh cluster DAPI arbitrary callable deserialization and RBAC context injection allow a cluster peer to execute privileged functions on the master node

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.14.5, issues in the Cluster Distributed API DAPI handling allow a cluster peer, or any actor able to authenticate to the cluster channel using the shared cluster key, to make the maste...