CVE-2026-14184

The CVE refers to the Academy LMS WordPress plugin before version 3.8.1, where several lesson AJAX handlers do not verify ownership of a user-supplied identifier. This allows authenticated users with subscriber-level access to read and modify other users’ lesson notes and to mark other users’ les...

CVE-2026-14183

The CVE describes a vulnerability in the Classified Listing WordPress plugin prior to version 5.3.9. The payment-receipt handler does not verify that the targeted order belongs to the requesting user, enabling authenticated users with subscriber-level access to read payment receipt details for ot...

CVE-2026-16266

Mongo-object versions before 3.0.3 are vulnerable to prototype pollution via the expandKey() function in util.js, allowing an attacker to modify Object.prototype by crafting paths containing proto . This can lead to DoS or potentially remote code execution, depending on how polluted prototypes im...

CVE-2026-16266

Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as proto...

CVE-2026-16266

Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as proto...

EUVD-2026-46151

Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as proto...

CVE-2026-16266

Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as proto...

KLA91163 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information. Below is a complete list of vulnerabilities: 1. Denial of service...

PT-2026-61877

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A privilege escalation issue exists within the DOM: Workers component. Recommendations Update Firefox to version 153. Update Thunderbird to version 153...

PT-2026-61883

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 Description A privilege escalation issue exists within the DOM: Navigation component. Recommendations...

PT-2026-61900

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Thunderbird versions prior to 153 Description A sandbox escape exists within the DOM networking component. A sandbox is a security mechanism used to isolate running applications from the rest of the system to...

PT-2026-63002

Name of the Vulnerable Software and Affected Versions Oracle Application Object Library versions 12.2.3 through 12.2.15 Description An issue exists within the DB Privileges component of the Oracle Application Object Library. A low privileged attacker with network access via HTTP can compromise th...

PT-2026-61975

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains an insecure direct object reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. This issue...

PT-2026-61964

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains an insecure direct object reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. This issue...

PT-2026-63001

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Core. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Obje...

PT-2026-63004

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Application Object Library versions 12.2.3 through 12.2.15 Description An issue in the Core component of the Oracle Application Object Library allows an unauthenticated attacker with network access via HTTP to...

PT-2026-62770

Name of the Vulnerable Software and Affected Versions Oracle Application Object Library versions 12.2.3 through 12.2.15 Description A flaw in the Core component of the Oracle Application Object Library allows a low privileged attacker with network access via HTTPS to compromise the system. This...

KLA91164 Multiple vulnerabilities in Mozilla Firefox

Multiple vulnerabilities were found in Mozilla Firefox. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. Security...

PT-2026-61967

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains an insecure direct object reference IDOR flaw, which occurs when an application provides direct access to objects based on user-supplied input. This issue...

PT-2026-61891

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 153 Firefox ESR versions prior to 140.13 Thunderbird versions prior to 153 Thunderbird versions prior to 140.13 Description A privilege escalation issue exists within the DOM: Content Processes component...