Oracle E-Business Suite: CVE-2026-101692: Critical Patch Update

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite component: Admin UI. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service...

Oracle E-Business Suite: CVE-2026-101697: Critical Patch Update

Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite component: Admin Console UI. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle One-to-One...

PT-2026-119338

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite component: Admin UI. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field...

PT-2026-118352

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethodstrue. The servlet routes requests using Path.ofpathInfo.getFileName, which strips all leading segments and...

Plex Media Server External Control of File Name or Path Vulnerability

Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655...

PT-2026-118337

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin course editor, admin quiz editor and admin question editor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with anoth...

PT-2026-119336

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite component: Admin UI. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field...

PT-2026-118482

SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local bypass authentication mode where enforce authentication in api service/auth/middleware.py trusts the client-controlled request.remote addr value, which is derived from the spoofable X-Forwarded-For header due to...

PT-2026-119337

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite component: Admin UI. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Mobile Field Service...

PT-2026-119339

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite component: Admin UI. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service...

Oracle E-Business Suite: CVE-2026-101694: Critical Patch Update

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite component: Admin UI. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Mobile Field Servic...

PT-2026-118334

react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's...

PT-2026-118483

An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

PT-2026-119341

Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite component: Admin UI. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobile Field Service...

CVE-2025-54309

CVE-2025-54309 CrushFTP Authentication Bypass Overview CVE-2025-54309 is an authentication bypass vulnerability in CrushFTP that allows unauthorized administrative user creation through AS2 header manipulation. Technical Details Vulnerability Location File : crushftp/server/ServerSessionHTTP.java...

CVE-2022-35501

CVE-2022-35501 Stored Cross-site Scripting XSS in blog-post creation functionality in Amasty Blog Pro for Magento 2 Description The post creation functionality in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 allows injection of JavaScript code in the title field, leading to XSS...

PoC-CVE-2022-4939-

PoC-CVE-2022-4939 The attacker sends a specially crafted request to the wpajaxnoprivwcfmajaxcontroller AJAX action to modify the membership registration form and set the registration role to that of an administrator. Then, the plugin processes the request and modifies the membership registration...

CVE-2024-31114

CVE-2024-31114 - WordPress Shortcode Addons RCE Exploit Shortcode Addons = 3.2.5 – Authenticated Admin+ Arbitrary File Upload CVE ID: CVE-2024-31114 CVSS Score: 9.1 Critical 🛠️ Vulnerability Description The Shortcode Addons – with Visual Composer, Divi, Beaver Builder, and Elementor Extension...

CVE-2021-41074

CVE-2021-41074 CSRF in Qloapps HotelCommerce 1.5.1 There is a CSRF in HotelCommerce 1.5.1. It can allow anyone to change the admin email. If an attacker gets an admin to click a maliciously crafted html document, they can change the admin user email...

CVE-2023-22518

CVE-2023-22518 Exploit for Confluence CVE-2023-22518 backup-restore RCE Endpoint POST /setup/setup-restore.action Requires valid login and admin rights or an auth bypass Files xmlexport-20231127-071916-1.zip – empty Confluence backup. Restoring this will DELETE all data!!! Replace with any backup...