CVE-2026-54543 Froxlor DomainZones.add allows DNS zone-file RR injection via record/type fields

Froxlor is open source server administration software. Prior to 2.3.8, the DomainZones.add API command in lib/Froxlor/Api/Commands/DomainZones.php accepts user-controlled record and type values without rejecting line delimiters, tab characters, semicolons, or unsupported DNS record types before...

WordPress WP Travel Engine plugin < 6.8.5 - Unauthenticated Booking Details Disclosure and Modification via wte_add_trip_to_cart vulnerability

Unauthenticated Booking Details Disclosure and Modification via wteaddtriptocart vulnerability discovered by Usama Arshad in WordPress Plugin WP Travel Engine versions 6.8.5...

OPENSUSE-SU-2026:21590-1 Security update for kubevirt1.8

This update for kubevirt1.8 fixes the following issues: Update to version 1.8.4. Security issues fixed: - CVE-2026-13201: virt-handler-rhel9: kubevirt: safepath OpenAtNoFollow symlink following via /proc/self/fd allows host file metadata modification bsc1269093. - CVE-2026-13622: virt-handler...

mysql: Pluggable Auth unspecified vulnerability (CPU Jul 2026)

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and 9.7.0-9.7.1...

CVE-2026-69189 Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers

Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...

WordPress ECS plugin < 4.3.8 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers vulnerability

Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers vulnerability discovered by Seongwon LEE in WordPress Plugin ECS – Ele Custom Skin for Elementor versions 4.3.8...

PT-2026-77347

Name of the Vulnerable Software and Affected Versions Oracle Hospitality Simphony versions 19.8 through 19.8.5 Oracle Hospitality Simphony versions 19.9 through 19.9.3 Oracle Hospitality Simphony versions 19.10 through 19.10.1 Description An unauthenticated attacker with network access via HTTP c...

PT-2026-77967

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Content Acquisition System component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successf...

PT-2026-77984

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Content Acquisition System component allows an unauthenticated attacker with network access via HTTP to compromise the system. This can...

PT-2026-77810

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Internet Procurement Connector versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component of the Oracle Internet Procurement Connector allows a low privileged attacker with network...

PT-2026-78097

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon version 4.5.0 Description A flaw in the Imperative Web Server component allows a low privileged attacker with network access via HTTPS to compromise the system. Successful exploitation can lead to unauthorized...

PT-2026-77895

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Data Relationship Management version 11.2.25.0.000 Description An issue exists in the Access and security component that allows a low privileged attacker with access to the infrastructure where the software executes to compromi...

PT-2026-77378

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM End User versions 17.0 through 26.6 Description A flaw exists in the Search component of the Oracle Siebel CRM End User product. An unauthenticated attacker with access to the physical communication segment attached to the...

PT-2026-77950

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 Description An issue exists in the Installation and Configuration component that allows a low privileged attacker with network access via HTTP to compromise the system. Successful...

PT-2026-77828

Name of the Vulnerable Software and Affected Versions Oracle Landed Cost Management versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Landed Cost Management product of Oracle E-Business Suite. A low privileged attacker with network acce...

PT-2026-77993

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Experience Manager component allows a low privileged attacker with network access via HTTP to compromise the system. This issue can lea...

PT-2026-77503

Name of the Vulnerable Software and Affected Versions Oracle JD Edwards EnterpriseOne Orchestrator versions 9.2.0.0 through 9.2.26.4 Description A security flaw in the E1 IOT Orchestrator Security component allows a low privileged attacker with network access via HTTP to compromise the system. Th...

PT-2026-77707

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Sales Foundation versions 12.2.3 through 12.2.15 Description A flaw in the Security API component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation ca...

PT-2026-77885

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Data Relationship Management version 11.2.25.0.000 Description A flaw in the Access and security component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead...

PT-2026-78205

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon version 3.2.18 Description A flaw in the Imperative Web Server component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to unauthorize...