PT-2026-63138

Vulnerability in the Oracle Sales for Handhelds product of Oracle E-Business Suite component: Outlook Sync Win 32. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales for...

PT-2026-63187

Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite component: Lease Authoring. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Lease...

PT-2026-63177

Vulnerability in the Oracle HRMS UK product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS UK. Successful...

PT-2026-62797

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Supply Chain Trading Connector versions 12.2.3 through 12.2.15 Description A flaw in the Collaboration History component allows a low privileged attacker with network access via HTTP to compromise the system. Thi...

PT-2026-63128

Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite component: RDBMS and UI. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Call Center...

PT-2026-63173

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Contracts Integration versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Contracts Integration product. An unauthenticated attacker with network access...

PT-2026-63123

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle iSupport versions 12.2.3 through 12.2.15 Description A flaw in the Call Back component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to unauthorized read...

The vulnerability of the Console component of the Oracle WebLogic Server application server allows a attacker to gain access to read, modify, or delete data.

The vulnerability of the Console component of the Oracle WebLogic Server application server is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain read, modify, or delete access to data...

PT-2026-63236

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Work in Process versions 12.2.5 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. Successful...

PT-2026-62514

Name of the Vulnerable Software and Affected Versions Oracle Unified Directory versions 12.2.1.4.0 Oracle Unified Directory versions 14.1.2.1.0 Description A flaw in the OUD Core component of Oracle Fusion Middleware allows a high privileged attacker with network access via LDAP to compromise the...

PT-2026-63134

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite component: Role Based Security. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub...

PT-2026-63192

Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public...

EUVD-2026-42272

File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope...

GHSA-8WC8-HF36-MJH9 File Browser: ScopedFs follows a dangling symlink on write, letting a scoped user create files outside their scope

Summary ScopedFs confines every File Browser user to a scope directory. Its within guard is meant to reject any operation that follows a symbolic link out of that scope. When the link target does not exist yet, the guard walks up to the nearest existing ancestor and validates that instead. For a...

CVE-2026-32821

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated API user who has their own access token can ask the...

CVE-2026-12973

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...

EUVD-2026-45887

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...

CVE-2026-12973

The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to unauthenticated users, allowing them to disclose the secret order key of arbitrary WooCommerce orders and, under some configurations, to...

PT-2026-61540

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

PT-2026-61736

Name of the Vulnerable Software and Affected Versions NextCRM version 0.12.1 Description The MCP campaign tools expose read and write operations over the network using user-generated Bearer API tokens nxtc .... The application fails to properly validate the authenticated user ID in multiple MCP...