EUVD-2026-46966

Vulnerability in the PeopleSoft Enterprise CS Financial Aid product of Oracle PeopleSoft component: Institutional Methodology Need Analysis. The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where...

EUVD-2026-46975

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft component: Security. The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS...

EUVD-2026-46964

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft component: Common Application Objects. The supported version that is affected is 9.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

PT-2026-63323

The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete locations backup file callback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2026-62507

Vulnerability in the Oracle Time and Labor product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Time and Labor...

CVE-2026-61329

Vulnerability in the Oracle Price Protection product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Price...

CVE-2026-61333

Vulnerability in the Oracle Product Workbench product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product...

CVE-2026-61173

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Security. The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this...

CVE-2026-61122

Vulnerability in the Oracle HRMS UK product of Oracle E-Business Suite component: UK Payroll. Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS UK. Successful attacks of...

CVE-2026-61071

Vulnerability in the PeopleSoft Enterprise FIN Engineering Argentina product of Oracle PeopleSoft component: Engineering. The supported version that is affected is 9.1. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft...

CVE-2026-61019

Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Customers...

CVE-2026-60617

Vulnerability in the PeopleSoft Enterprise CS Campus Community product of Oracle PeopleSoft component: Security. The supported version that is affected is 9.2.38. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS...

CVE-2026-60587

Vulnerability in the Oracle Project Foundation product of Oracle E-Business Suite component: Project Definition. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Project...

CVE-2026-44878

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...

@vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Summary Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem taking screenshots, managing Playwright traces, uploading files for , comparing screenshots. Several of these commands accept a file path from the browser a...

CVE-2026-63858

A flaw was found in the Linux kernel's netfilter nftables subsystem. This vulnerability could lead to a denial of service for network filtering operations. The issue occurs because the process of deleting network hooks improperly modifies a protected list, which can disrupt how network...

CVE-2026-47412

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive action. The DELETE /workspaces/workspaceid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member". Any membe...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the file-op delete path. An attacker can delete files outside the intended build root by sending a crafted low-level build API request with FileActionRm.Path values such as .. or ../victim. The vulnerable path...

CVE-2026-47412 praisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}

PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive action. The DELETE /workspaces/workspaceid endpoint is gated only by requireworkspacememberworkspaceid default minrole="member". Any membe...

CVE-2026-47412

CVE-2026-47412 describes an authorization bypass in PraisonAI Platform: versions prior to 0.1.4 allow any workspace member to delete the entire workspace via DELETE /workspaces/{workspace_id}, because the endpoint is gated only by require_workspace_member with a default min_role of member. The im...