PT-2026-92597

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM Siebel CRM Cloud Applications versions 22.3 through 26.7 Description An issue exists in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications. An unauthenticated attacker with access to the physical...

PT-2026-92411

Name of the Vulnerable Software and Affected Versions Devolutions Server versions prior to 2026.2.17 Description A Server-Side Request Forgery SSRF issue exists in the VMware synchronization feature. This allows a low-privileged authenticated user to reach internal or cloud-metadata network...

PT-2026-92159

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Business Automation affected versions not specified Description An authenticated user can embed arbitrary JavaScript code into the Web UI. This stored cross-site scripting issue allows for the alteration of intended...

PT-2026-92160

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Business Automation affected versions not specified Description An authenticated user can embed arbitrary JavaScript code into the Web UI. This stored cross-site scripting issue allows for the alteration of intended...

PT-2026-92599

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM Siebel CRM Cloud Applications versions 22.3 through 26.7 Description An issue exists in the Siebel Cloud Manager component of Oracle Siebel CRM Cloud Applications. An unauthenticated attacker with network access via HTTP can...

PT-2026-92161

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Business Automation affected versions not specified Description An HTML injection flaw allows a remote attacker to inject malicious HTML code. When viewed, this code is executed in the victim's web browser within the security...

PT-2026-92119

Name of the Vulnerable Software and Affected Versions Yonyou U8 Cloud affected versions not specified Description An unauthenticated Java deserialization issue exists in the nc.impl.pub.filesystem.FileManageServlet component. Remote attackers can execute arbitrary OS commands by sending a...

PT-2026-91936

lamp-cloud through 5.10.0 whitelists the path pattern //anno/ for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath...

PT-2026-92058

Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader nodes that bypass SSRF protection. Attackers can provide arbitrary URLs to fetch cloud metadata, internal services, and private network resources with response...

CVE-2026-11864: Improper Neutralization of Data within XPath Expressions

IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 Interim Fix 008, and 24.0.0 through 24.0.0 Interim Fix 009 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to...

CVE-2026-54688: Server-Side Request Forgery (SSRF)

mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.2.0, weburlread passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed in src/url-reader.ts runs only when MCPHTTPHARDEN is enable...

CVE-2026-54549: Server-Side Request Forgery (SSRF)

Meta Ads MCP is a Model Context Protocol MCP server that lets AI assistants run Meta Ads. Prior to version 1.0.115, the uploadadimage tool in metaadsmcp/core/ads.py passes an attacker-controlled imageurl to trymultipledownloadmethods in metaadsmcp/core/utils.py, where httpx.AsyncClient uses...

CVE-2026-12751: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2026-12750: Improper Neutralization of Input During Web Page Generation

IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2026-12749: Improper Neutralization of Input During Web Page Generation

IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2026-83419: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications component: SEPP. Supported versions that are affected are 26.1.200 and 25.2.201. Easily exploitable vulnerability allows low privileged attacker with network access via HTT...

CVE-2026-83418: Improper Access Control

Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications component: SEPP. Supported versions that are affected are 26.1.200 and 25.2.201. Difficult to exploit vulnerability allows low privileged attacker with network access via...

CVE-2026-83417: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications component: SEPP. Supported versions that are affected are 26.1.200 and 25.2.201. Easily exploitable vulnerability allows unauthenticated attacker with access to the physica...

CVE-2026-91996: Missing Authentication for Critical Function

lamp-cloud through 5.10.0 whitelists the path pattern //anno/ for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath...

CVE-2023-54398: Deserialization of Untrusted Data

Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component that allows remote unauthenticated attackers to execute arbitrary OS commands by sending a serialized payload via POST request. Attackers can exploit the doActi...