PT-2026-92300

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Improper input validation in multiple locations allows for an out-of-bounds write, which is a condition where data is written outside the boundaries of a...

CVE-2026-79411

Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint route admin.settings.users.update, UserController::update...

PT-2026-92095

Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only share link can enumerate project users via the projects endpoint and confirm arbitrary usernames exist via the global search endpoint...

PT-2026-92192

pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target...

CVE-2026-81922: Missing Authorization

Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, the sendtotop and sendtobottom reorder tasks ran after only a generic sitemap-access check; the controller loaded the page named by the...

CVE-2026-18110: Missing Authorization

Concrete CMS 9 9.0.0 through 9.5.2 does not perform an authorization check on the user selector autocomplete endpoint /ccm/system/user/autocomplete, which backs the "Preview as User" panel and other user-selector components. The endpoint validates only a CSRF-style access token that is bound to t...

PT-2026-92643

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle User Management versions 12.2.6 through 12.2.15 Description A flaw in the Internal Operations component of the Oracle User Management product allows a low privileged attacker with network access via HTTP to...

PT-2026-92324

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic error in the code allows for a use-after-free condition, which occurs when a program continues to use a pointer after it has been freed. This issue could...

PT-2026-92147

Name of the Vulnerable Software and Affected Versions IBM Security Verify Identity Access Reverse Proxy affected versions not specified Description In certain configurations, the software may provide weaker than expected cryptographic validation of user supplied data. Recommendations At the momen...

PT-2026-92430

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Orchestrator affected versions not specified Description Privilege escalation flaws exist in the API of the orchestrator. A remote authenticated user with low privileges can exploit these issues to gain...

PT-2026-92336

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An out-of-bounds read occurs in multiple files due to type confusion, which is a situation where a program accesses a resource using a type that is different fro...

PT-2026-92332

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A missing bounds check in the get global config item addr function within the gc.c file allows for a possible out-of-bounds read. This condition can be leveraged...

PT-2026-92764

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description An issue exists in the Forge component that allows an unauthenticated attacker with network access via HTTP to compromise the system. Exploitation is...

PT-2026-92891

Name of the Vulnerable Software and Affected Versions Oracle Identity Manager versions 12.2.1.4.0 Oracle Identity Manager versions 14.1.2.1.0 Description An issue exists in the OIM Legacy UI component of Oracle Fusion Middleware. An unauthenticated attacker with network access via HTTP can...

PT-2026-92360

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A race condition in multiple locations may lead to a use-after-free scenario, where the system continues to use a memory address after it has been freed. This...

PT-2026-92356

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A missing bounds check in the DecodeFilmGrainParams function within the film grain dec.cc file allows for an out-of-bounds write. This condition can be leveraged...

CVE-2026-76669: Improper Privilege Management

Privilege escalation vulnerabilities exist in the API of HPE Networking EdgeConnect SD-WAN Orchestrator. Successful exploitation could allow a remote low-privileged authenticated user to escalate their privileges to those of an administrative user, leading to complete system compromise...

CVE-2026-83189: Improper Privilege Management

Vulnerability in the Oracle User Management product of Oracle E-Business Suite component: Proxy User Delegation. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle User...

CVE-2026-81303: Unintended Proxy or Intermediary

A flaw was found in hawtio-operator. The operator holds routes/custom-host:create permission cluster-wide and writes the tenant-supplied spec.routeHostName value from the Hawtio custom resource directly into the Route spec without validation or authorization checks. A namespace edit user, who...

CVE-2026-49446: Improper Authorization

Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role,...