PT-2026-77936

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Payroll versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component of Oracle Payroll allows a low privileged attacker with network access via HTTP to compromise the system. This issue...

PT-2026-77982

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Content Acquisition System component allows an unauthenticated attacker with access to the infrastructure where the software executes t...

PT-2026-77995

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Experience Manager. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

PT-2026-77949

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 Description An issue exists in the Installation and Configuration component that allows an unauthenticated attacker with network access via HTTP to compromise the system. Successf...

PT-2026-77458

Name of the Vulnerable Software and Affected Versions Oracle Managed File Transfer version 12.2.1.4.0 Oracle Managed File Transfer version 14.1.2.0.0 Description A flaw in the MFT Runtime Server component of Oracle Fusion Middleware allows a low privileged attacker with network access via T3 and...

PT-2026-77795

Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle SDP Number...

PT-2026-78028

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description An unauthenticated attacker with network access via HTTP can compromise the Oracle Commerce Guided Search / Oracle Commerce Experience Manager. This...

PT-2026-77465

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Sites version 12.2.1.4.0 Oracle WebCenter Sites version 14.1.2.0.0 Description A flaw in the Oracle WebCenter Sites component of Oracle Fusion Middleware allows a low privileged attacker with network access via HTTP to...

PT-2026-77763

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion component: Server. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial...

PT-2026-77981

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw exists in the Content Acquisition System component. This issue allows an unauthenticated attacker with network access via HTTP to compromise t...

PT-2026-77896

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Data Relationship Management version 11.2.25.0.000 Description A flaw in the Access and security component allows a low privileged attacker with network access via HTTPS to compromise the system. The exploitation requires human...

PT-2026-77911

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Financial Management version 11.2.25.0.000 Description A security flaw in the Security component allows a low privileged attacker with network access via SQL to compromise the system. Successful exploitation can lead to a full...

PT-2026-77357

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.4.0 Oracle WebLogic Server version 14.1.1.0.0 Oracle WebLogic Server version 14.1.2.0.0 Oracle WebLogic Server version 15.1.1.0.0 Description A flaw in the Core component of Oracle WebLogic Server allows ...

PT-2026-78175

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in...

PT-2026-77392

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM versions 17.0 through 26.6 Description A flaw in the Migration component of the Siebel CRM Deployment product allows a low privileged attacker with network access via HTTP to compromise the system. This issue can lead to...

CVE-2026-45791

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.sessiontoken session to remain valid for u...

CVE-2026-45791 Dokploy: Password Change Does Not Revoke Active Sessions

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.sessiontoken session to remain valid for u...

CVE-2026-45791

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.sessiontoken session to remain valid for u...

EUVD-2026-60477

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.sessiontoken session to remain valid for u...

CVE-2026-45791 Dokploy: Password Change Does Not Revoke Active Sessions

Dokploy is a free, self-hostable Platform as a Service PaaS. Prior to 0.29.6, Dokploy's user.update procedure in apps/dokploy/server/api/routers/user.ts updates account.password without deleting other rows from session, allowing a compromised better-auth.sessiontoken session to remain valid for u...