PT-2026-92329

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A logic error in the code across multiple locations allows for a local escalation of privilege. This issue enables an attacker to gain System execution privileg...

PT-2026-92667

Vulnerability in the Siebel Apps - Customer Order Management product of Oracle Siebel CRM component: Order Management. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel Apps -...

PT-2026-92308

Name of the Vulnerable Software and Affected Versions Cellular Modem affected versions not specified Description A logic error in the code allows for possible information disclosure. This flaw could be leveraged to achieve remote code execution without requiring additional execution privileges or...

CVE-2026-79411

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint route admin.settings.users.update, UserController::update...

EUVD-2026-79300

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint route admin.settings.users.update, UserController::update...

PT-2026-92293

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic error in the code allows for a permission bypass in multiple locations. This issue can lead to local escalation of privilege, granting System execution...

PT-2026-92764

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description An issue exists in the Forge component that allows an unauthenticated attacker with network access via HTTP to compromise the system. Exploitation is...

CVE-2026-49446: Improper Authorization

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role,...

PT-2026-92121

Name of the Vulnerable Software and Affected Versions Concrete CMS versions 9.0.0 through 9.5.2 Description An authorization check is missing on the user selector autocomplete endpoint '/ccm/system/user/autocomplete', which supports the Preview as User panel and other user-selector components. Th...

PT-2026-92729

Vulnerability in the Oracle Banking Corporate Lending Process Management product of Oracle Financial Services Applications component: Base. Supported versions that are affected are 14.5.0.0.0-14.9.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTT...

PT-2026-92324

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic error in the code allows for a use-after-free condition, which occurs when a program continues to use a pointer after it has been freed. This issue could...

PT-2026-92163

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 18.6 through 19.1.7 GitLab CE/EE versions 19.2 through 19.2.5 GitLab CE/EE versions 19.3 through 19.3.1 Description An issue exists where an authenticated user could bypass SAML SSO sign-in restrictions and authenticate...

PT-2026-92712

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite versions 12.2.3 through 12.2.15 Description An issue exists in the Proxy User Delegation component of the Oracle User Management product. A low privileged attacker with network access via HTTP can exploit this flaw to...

CVE-2026-79411

The Webkul Bagisto 2.4.9 software is vulnerable to vertical privilege escalation due to an incorrect privilege assignment in the admin user-management component. The user-update endpoint (route admin.settings.users.update, UserController::update()) fails to verify if an actor is permitted to gran...

PT-2026-92770

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Forge component allows an unauthenticated attacker with access to the infrastructure where the software executes to compromise the...

CVE-2026-56830: Missing Authorization

Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store in packages/admin/src/Livewire/Components/Products/Form/Media.php without the editproducts authorization check used by sibling sub-forms. An authenticated staff user with...

PT-2026-92021

An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what path they can be set to by an admin user. Setting these properties to specific file paths can reveal information to the client side. Three specific properties...

ROS-20260915-73-0063

The vulnerability of the WebUI user interface of Google Chrome and Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow a malicious actor to perform domain substitution using a created domain name...

CVE-2026-83146: Improper Access Control

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM component: Open UI. Supported versions that are affected are 17.0-26.7. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks requir...

PT-2026-92387

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint route admin.settings.users.update, UserController::update...