PT-2026-62768

Name of the Vulnerable Software and Affected Versions Oracle Complex Maintenance, Repair and Overhaul versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite. A low...

PT-2026-62830

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Order Management versions 12.2.3 through 12.2.15 Description A flaw exists in the Product Diagnostic Tools component of Oracle Order Management. A high privileged attacker with network access via HTTP can exploit...

PT-2026-63011

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Configure to Order versions 12.2.3 through 12.2.15 Description A flaw in the Supply to Order Workbench component allows a low privileged attacker with network access via HTTP to compromise the system. This issue can lea...

📄 WordPress Atarim Visual Collaboration 4.2.1 Privilege Escalation

WordPress Atarim Visual Collaboration plugin version 4.2.1 contains an authenticated Subscriber+ privilege escalation to advisor vulnerability. This proof of concept exploit demonstrates the vulnerable request flow against the affected plugin. !/usr/bin/env python3 Exploit Title: WordPress Plugin...

PT-2026-62739

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM Siebel CRM Cloud Applications versions 22.3 through 26.5 Description A flaw in the Siebel Cloud Manager component allows a low-privileged attacker with access to the infrastructure where the application executes to compromise...

PT-2026-62725

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Asset Management versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation requires...

PT-2026-62719

Vulnerability in the Oracle U.S. Federal Financials product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle U.S...

PT-2026-62779

Name of the Vulnerable Software and Affected Versions Oracle iReceivables versions 12.2.3 through 12.2.15 Description An issue exists in the AR Web Utilities component of the Oracle iReceivables product within Oracle E-Business Suite. An unauthenticated attacker with network access via HTTP can...

PT-2026-62938

Name of the Vulnerable Software and Affected Versions Oracle Production Scheduling versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Production Scheduling product of Oracle E-Business Suite. A high privileged attacker with access to the...

PT-2026-62968

Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite component: Regression Testing. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability

Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET XML Encryption System.Security.Cryptography.Xml. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A denial ...

Uncontrolled Recursion

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Uncontrolled Recursion in the defaultVisitor function of lib/helpers/toFormData.js, which calls JSON.stringify on a value when its top-level key ends in ,...

File Browser: Archive builder turns backslash filenames into path traversal (zip-slip)

Summary The fix for GHSA-gxjx-7m74-hcq8 / CVE-2026-54093 shipped in v2.63.6 added a strings.ReplaceAllnameInArchive, "\", "/" step to the archive builder; this was the advisory's recommended "Primary Fix." On a Linux host a backslash is a legal, non-separator filename character, so replacing it...

EUVD-2026-41558

webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints...

CVE-2026-64626 AVideo Encoder downloadURL SSRF via unpinned retry fallback

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an intern...

NPM: Socket.IO: Engine.IO Polling Transport Connection Exhaustion

NPM: Socket.IO: Engine.IO Polling Transport Connection Exhaustion vulnerability discovered by ? in WordPress Npm engine.io versions = 4.1.0, 6.6.7...

CVE-2026-56623

Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories...

CVE-2026-53595 FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.224, the public endpoint POST /user-setup/hash/invitesentat OpenController@userSetupSave selects the target account solely by its invitehash column, then overwrites that account's email and...

CVE-2026-53591 FreeScout Vulnerable to Unauthenticated Conversation Thread Injection via HMAC Length Bypass in FetchEmails

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.223, an unauthenticated attacker can inject messages into any existing support conversation by sending a single email to the helpdesk's public address with a crafted In-Reply-To header. No...

CVE-2026-53591

FreeScout (Laravel-based) prior to v1.8.223 is vulnerable: an unauthenticated attacker can inject messages into existing conversations by sending an email to the public address with a crafted In-Reply-To header. The injected message appears as a legitimate customer reply, reopens the conversation...