Plone Volto < 16.34.0 / 17.x < 17.22.1 / 18.x < 18.24.0 / 19.0.0-alpha.1 < 19.0.0-alpha.4 DoS

The version of the @plone/volto Node.js Package installed on the remote host is prior to 16.34.0, or 17.x prior to 17.22.1, or 18.x prior to 18.24.0, or 19.0.0-alpha.1 prior to 19.0.0-alpha.4. It is, therefore, affected by a denial of service vulnerability. An unauthenticated, remote attacker, ca...

PT-2026-63432

Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft malicious payloads in customer order placement that execute ...

Plone < 3.3.6 / 4.0.x < 4.0.8 Privilege Escalation (HF 20110622)

The version of Plone installed on the remote host is prior to 3.3.6 or 4.0.x prior to 4.0.8. It is, therefore, affected by a privilege escalation vulnerability. An unauthenticated, remote attacker can exploit this to gain administrative access to the application. Note that Nessus has not tested f...

PT-2026-63340

Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data...

PT-2026-63336

The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.6. This is due to the software allowing users to execute an action that does not properly validate a value before running do shortcode. Thi...

PT-2026-63448

Name of the Vulnerable Software and Affected Versions IBM Sterling B2B Integrator versions 6.2.0.0 through 6.2.0.5 2 IBM Sterling B2B Integrator versions 6.2.1.0 through 6.2.1.1 2 IBM Sterling B2B Integrator versions 6.2.2.0 through 6.2.2.0 1 IBM Sterling File Gateway versions 6.2.0.0 through...

Plone 2.0.x < 2.1.3 Insecure Access Control

The version of Plone installed on the remote host is 2.0.x prior to 2.1.3. It is, therefore, affected by an insecure access control due to not restricting access to the changeMemberPortrait, deletePersonalPortrait, and testCurrentPassword methods. An unauthenticated, remote attacker can exploit...

Plone products.isurlinportal < 1.2.0 Open Redirect

The version of Plone products.isurlinportal installed on the remote host is prior to 1.2.0. It is, therefore, affected by an open redirect vulnerability. An unauthenticated, remote attacker, can exploit this, via the 'is url in portal', to redirect to an external website after login. Note that...

PT-2026-63344

n8n before 2.28.0 and before 2.27.4 on the 2.27.x branch registers the DELETE /$restEndpoint/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The...

Plone < 2.5.5 / 3.x < 3.3.6 / 4.x < 4.0.4 Privilege Escalation (HF 20110720)

The version of Plone installed on the remote host is prior to 2.5.5, 3.x prior to 3.3.6, or 4.x prior to 4.0.4. It is, therefore, affected by a privilege escalation vulnerability. An unauthenticated, remote attacker can exploit this to gain administrative access to the application. Note that Ness...

Oracle MySQL Cluster 8.4.x < 8.4.11 (July 2026 CPU)

The versions of MySQL Cluster installed on the remote host are affected by multiple vulnerabilities as referenced in the July 2026 CPU advisory. - Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Group Replication Plugin. Supported versions that are...

CVE-2026-65317

Verba RAG application version 2.1.3 contains a server-side request forgery vulnerability combined with a same-origin middleware bypass that allows unauthenticated remote attackers to make the server issue arbitrary HTTP requests by supplying a crafted Origin header and attacker-controlled host an...

CVE-2026-65319

Feedbin commit 739884a contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve private article content by sending requests to the entries text API endpoint, which skips the authorization before-action filter entirely. Attackers can iterat...

CVE-2026-8985

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands...

CVE-2026-62547

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow...

CVE-2026-62517

Vulnerability in the Oracle Production Scheduling product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-62486

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-62487

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Contract...

CVE-2026-62484

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-62443

Vulnerability in the Oracle Contracts Integration product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Contract...