PT-2026-63134

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite component: Role Based Security. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub...

PT-2026-62238

Name of the Vulnerable Software and Affected Versions Oracle APEX version 24.1 Oracle APEX version 24.2 Oracle APEX version 26.1 Description An issue in the General component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can resu...

PT-2026-62150

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Agent Next Gen. Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

PT-2026-62634

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft Enterprise FIN eSettlements version 9.2 Description A flaw in the eSettlements component allows a high-privileged attacker with access to the infrastructure where the software executes to compromise the system. This can lead ...

PT-2026-63123

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle iSupport versions 12.2.3 through 12.2.15 Description A flaw in the Call Back component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to unauthorized read...

PT-2026-62400

Name of the Vulnerable Software and Affected Versions Oracle Data Integrator version 12.2.1.4.0 Oracle Data Integrator version 14.1.2.0.0 Description A flaw exists in the Patchset Assistant component of Oracle Fusion Middleware. A low privileged attacker with access to the infrastructure where th...

CVE-2026-63820 f2fs: fix missing read bio submission on large folio error

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix missing read bio submission on large folio error f2fsreaddatalargefolio can keep a read bio across multiple readahead folios. If a later folio hits an error before any of its blocks are added to the bio, folioinbio is...

CVE-2026-63811 f2fs: read COW data with the original inode during atomic write

In the Linux kernel, the following vulnerability has been resolved: f2fs: read COW data with the original inode during atomic write When updating an atomic-write file, f2fswritebegin may read the previously written data back from the COW inode: prepareatomicwritebegin locates the block in the COW...

CVE-2026-53447

Wekan (open-source Kanban) contains a vulnerability in the cloneBoard Meteor method prior to version 9.35. The method in models/import.js uses a caller-supplied sourceBoardId to export a board via models/exporter.js without canExport checks or membership verification. As a result, any authenticat...

EUVD-2026-43591

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token...

CVE-2026-44761 Insecure Sample Credentials in SAP Commerce Cloud

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token...

CVE-2026-44761

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token...

CVE-2026-44761 Insecure Sample Credentials in SAP Commerce Cloud

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token...

PT-2026-58773

Name of the Vulnerable Software and Affected Versions Adobe Commerce affected versions not specified Magento Open Source affected versions not specified Adobe Commerce B2B affected versions not specified Description An incorrect authorization issue exists in the authorization mechanism. A...

PT-2026-57942

Name of the Vulnerable Software and Affected Versions SAP Commerce Cloud affected versions not specified Description SAP Commerce Cloud may retain a sample OAuth2 client with publicly documented credentials derived from sample configurations in the SAP Help Portal. An unauthenticated attacker can...

Open WebUI Authentication Bypass

The vulnerability of the Open WebUI web interface is related to deficiencies in the authentication process. Exploiting this vulnerability can allow a malicious actor to gain access to and modify data...

IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users

IKUS Rdiffweb version 2.10.5 and below have an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify...

PYSEC-2026-2831 Improper Restriction of Operations within the Bounds of a Memory Buffer in OpenCV

OpenCV Open Source Computer Vision Library through 3.3 corresponding to OpenCV-Python 3.3.0.9 has a buffer overflow in the cv::BmpDecoder::readData function in modules/imgcodecs/src/grfmtbmp.cpp when reading an image file by using cv::imread, as demonstrated by the 4-buf-overflow-readData-memcpy...

vantage6 collaboration admins can extend their influence by expanding the collaboration

ImpactCollaboration administrators can add extra organizations to their collaboration. When doing that, they extend their influence: for instance, for organizations that they include, they can then create new users for which they know the passwords, and use that to read task results of other...

PT-2026-56260

Name of the Vulnerable Software and Affected Versions FastGPT versions prior to 4.15.0 Description An issue exists where the endpoint "/api/core/ai/record/getRecord" authenticates the caller but fails to implement team scoping when loading LLM request and response traces. By providing a known...