PT-2026-63190

Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Public...

PT-2026-62797

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Supply Chain Trading Connector versions 12.2.3 through 12.2.15 Description A flaw in the Collaboration History component allows a low privileged attacker with network access via HTTP to compromise the system. Thi...

PT-2026-62953

Name of the Vulnerable Software and Affected Versions Oracle iRecruitment versions 12.2.3 through 12.2.15 Description An issue in the Install / Upgrade Issues component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to...

PT-2026-63096

Vulnerability in the Oracle Item Master product of Oracle E-Business Suite component: iSet-up bugs. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Item Master. Successful...

PT-2026-62491

Name of the Vulnerable Software and Affected Versions Oracle TimesTen In-Memory Database version 26.1.1.1.0 Description A flaw exists in the Kubernetes Operator component of the Oracle TimesTen In-Memory Database. A high-privileged attacker with access to the infrastructure where the database...

PT-2026-63187

Vulnerability in the Oracle Lease and Finance Management product of Oracle E-Business Suite component: Lease Authoring. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Lease...

PT-2026-62786

Name of the Vulnerable Software and Affected Versions Oracle TeleSales versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to unauthorized read access to a...

PT-2026-63138

Vulnerability in the Oracle Sales for Handhelds product of Oracle E-Business Suite component: Outlook Sync Win 32. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Sales for...

The vulnerability of the Console component of the Oracle WebLogic Server application server allows a attacker to gain access to read, modify, or delete data.

The vulnerability of the Console component of the Oracle WebLogic Server application server is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain read, modify, or delete access to data...

EUVD-2026-45460

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Fix page overflow in sevdbgcrypt for ENCRYPT path In sevdbgcrypt, the per-iteration transfer length is bounded by the source page offset PAGESIZE - soff but not by the destination page offset PAGESIZE - doff. When doff...

CVE-2026-59237

Roskus Prospero Flow CRM prior to 5.5.3 is affected by an IDOR (CWE-639) vulnerability in the Order and OrderItem REST API controllers. The issue arises because Order::find($id) / Item::find($id) are not scoped to the authenticated user’s company, enabling a remote, authenticated user to read, mo...

CVE-2026-44761

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token...

CVE-2026-58410 ChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records

ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an authorization flaw in the family-scoped endpoints which allowed low-privileged users to read and modify other families’ records. An authenticated non-admin user with EditSelf access can supply another...

EUVD-2026-42604

This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. XAPI can configure different users with different roles, using Role Based Access Control. For more details, see:...

CVE-2026-5268

An authentication bypass vulnerability exists in the default SFTP server component utilized across the Ciena products listed. This vulnerability allows a remote, unauthenticated attacker to bypass security controls and gain unauthorized access to the underlying filesystem. Successful exploitation...

CVE-2026-5268

An authentication bypass vulnerability exists in the default SFTP server component across various Ciena products . A remote, unauthenticated attacker can exploit this weakness to circumvent security controls and gain unauthorized access to the underlying filesystem . Successful exploitation could...

The vulnerability of the software interface of the Git-based software platform for collaborative code development on GitLab EE allows a perpetrator to gain unauthorized access to read and modify protected information.

The vulnerability of the software interface of a Git-based software platform for collaborative code development on GitLab EE is related to the bypassing of authentication using a key controlled by the user. Exploiting this vulnerability can allow an intruder, operating remotely, to gain...

The vulnerability of the Security Framework component of the Oracle Application Development Framework allows a perpetrator to gain unauthorized access for reading, updating, adding, or deleting protected information.

The vulnerability of the Security Framework component of the Oracle Application Development Framework is related to access control errors. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to read, update, add, or delete protected information...

The vulnerability of the PROXY protocol implementation in proxy servers for ProxySQL databases allows a hacker to bypass security restrictions and gain access to read and modify data.

The vulnerability of the PROXY protocol implementation in ProxySQL’s database server lies in the use of an unreliable data source during the loading of updates. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain access to read and modify data...

CVE-2026-56081

Cap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before that email is verified. By enabling two-factor authentication on the pre-registered account, the attacker gains control over the account...