PT-2026-63170

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Lease and Finance Management versions 12.2.11 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system...

PT-2026-62285

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 Description A flaw in the Core component of Oracle Fusion Middleware allows a low privileged attacker with network access via HTTP to compromise the server...

PT-2026-63154

Name of the Vulnerable Software and Affected Versions Oracle Product Hub versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a full...

PT-2026-62636

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft PeopleSoft Enterprise CS Student Records version 9.2.38 Description A flaw in the Research Tracking component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can...

PT-2026-62615

Name of the Vulnerable Software and Affected Versions Oracle Partner Management versions 12.2.3 through 12.2.15 Description A flaw in the Partner Dashboard component allows a low privileged attacker with network access via HTTPS to compromise the system. This can lead to unauthorized read, update...

PT-2026-63266

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Uncontrolled Resource Consumption in Kibana can lead to a denial of service through excessive allocation. A low-privileged authenticated user can send a specially crafted request to a machine...

PT-2026-62613

Name of the Vulnerable Software and Affected Versions Oracle SDP Number Portability versions 12.2.3 through 12.2.15 Description A flaw in the Installation component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to unauthorized update, insert...

PT-2026-62617

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Workflow versions 12.2.3 through 12.2.15 Description A flaw in the Workflow Notification Mailer component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to...

PT-2026-62211

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Security. Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

PT-2026-62587

Name of the Vulnerable Software and Affected Versions Oracle Managed File Transfer versions 12.2.1.4.0 and 14.1.2.0.0 Description A flaw in the MFT Runtime Server component of Oracle Fusion Middleware allows a low privileged attacker with network access via HTTP to compromise the system. Successf...

CVE-2026-55550

NextCRM is affected by an RBAC bypass in the MCP product tools. In version 0.12.1, write operations for the product catalog were exposed via /api/mcp/mcp using user-generated Bearer tokens without proper role checks, allowing any authenticated low-privileged user to create, modify, archive, or so...

CVE-2026-62418 Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check

Low-privileged authenticated Server-Side Request Forgery SSRF vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version...

CVE-2026-62418 Apache Syncope: Low-privileged authenticated SSRF in Connectors and Resources check

Low-privileged authenticated Server-Side Request Forgery SSRF vulnerability in Apache Syncope via Connectors and Resources check. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 Through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version...

Improper Handling of Insufficient Permissions or Privileges

Overview Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges via the gracefulShutdown RPC in AbstractServer. An authenticated low-privileged user can shut down Accumulo system components by sending a graceful shutdown request without...

PT-2026-60235

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.1 Splunk Enterprise versions prior to 10.2.5 Splunk Enterprise versions prior to 10.0.8 Splunk Enterprise versions prior to 9.4.13 Splunk Cloud Platform versions prior to 10.5.2605.0 Splunk Cloud Platfo...

EUVD-2026-44543

ColdFusion is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user...

CVE-2026-48371

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...

CVE-2026-47994

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...

CVE-2026-48371 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...

CVE-2026-47994 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Commerce is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerabl...