PT-2026-77399

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 Description A flaw in the Integration Broker component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful...

PT-2026-78093

Name of the Vulnerable Software and Affected Versions Oracle Hospitality OPERA 5 Property Services versions 5.6.28.0 through 5.6.28.1 Description An issue exists in the Opera Servlet component that allows an unauthenticated attacker with network access via HTTP to compromise the system...

PT-2026-77360

Name of the Vulnerable Software and Affected Versions Oracle Identity Manager versions 12.2.1.4.0 Oracle Identity Manager versions 14.1.2.1.0 Description A flaw in the OIM Legacy UI component of Oracle Fusion Middleware allows a low privileged attacker with network access via T3 and IIOP Internet...

CVE-2026-67920

Halo 2.25.4's MigrationServiceImpl.restoreWorkdir() fetches an arbitrary URL, extracts the zip's workdir/ into the Halo work dir unsanitized via FileSystemUtils.copyRecursively(), replacing the entire extension store and enabling RCE. A working exploit (exploit/migration_restore.py) is verified a...

EUVD-2026-61093

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir, and org.springframework.util.FileSystemUtils.copyRecursively components...

Microsoft Edge (Chromium) < 151.0.4129.86 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 151.0.4129.86. It is, therefore, affected by multiple vulnerabilities as referenced in the August 14, 2026 advisory. - Use after free in Blink in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execu...

PT-2026-77436

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Enterprise Capture version 12.2.1.4.0 Oracle WebCenter Enterprise Capture version 14.1.2.0.0 Description An issue exists in the Client Bundle component of Oracle WebCenter Enterprise Capture. An unauthenticated attacker with...

Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

Microsoft Internet Key Exchange IKE Service Extensions contains a double free vulnerability that could enable remote code execution...

PT-2026-77396

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 Description A flaw in the Business Interlink component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful...

CVE-2026-52607

A directory traversal vulnerability in reportico-web = 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the filename in the targetformat parameter in conjunction with the executemode=EXECUTE parameter of the run.php endpoint...

PT-2026-77424

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Enterprise Capture version 12.2.1.4.0 Oracle WebCenter Enterprise Capture version 14.1.2.0.0 Description An issue exists in the Client Bundle component of Oracle WebCenter Enterprise Capture. An unauthenticated attacker with...

PT-2026-77440

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Enterprise Capture version 12.2.1.4.0 Oracle WebCenter Enterprise Capture version 14.1.2.0.0 Description An issue exists in the Client Bundle component of Oracle WebCenter Enterprise Capture. An unauthenticated attacker with...

PT-2026-77331

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 151.0.7922.169 Description A race condition in the USB component allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the sandbox. This is...

PT-2026-77159

CodeWhale packages codewhale / codewhale-tui versions = 0.8.41 and 0.8.64 contain a remote code execution vulnerability in the rlm eval tool. The tool's approval requirement returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code ...

PT-2026-77171

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available...

PT-2026-77349

Name of the Vulnerable Software and Affected Versions Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 Description An issue in the Core component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via T3 and IIOP protocols to...

PT-2026-77917

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Workflow versions 12.2.3 through 12.2.15 Description A flaw in the Workflow Notification Mailer component allows an unauthenticated attacker with network access via SMTP to compromise the system. Successful...

PT-2026-77913

Name of the Vulnerable Software and Affected Versions Oracle Financial Services Enterprise Case Management version 8.0.8.2 Oracle Financial Services Enterprise Case Management version 8.1.2.11 Description A flaw in the Web UI component allows a low privileged attacker with network access via HTTP...

CVE-2026-67920

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir, and org.springframework.util.FileSystemUtils.copyRecursively components...

PT-2026-76973

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 154 Firefox ESR versions prior to 115.39 Firefox ESR versions prior to 140.14 Firefox ESR versions prior to 153.1 Thunderbird versions prior to 154 Thunderbird versions prior to 140.14 Thunderbird versions prior to...