CVE-2026-52826 Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/id/rate/rate, /en/admin/customer/id/rate/rate, and /en/admin/activity/id/rate/rate independently resolve the authorized parent identifier and the attacker-selected child rate identifier...

CVE-2026-52826 Kimai: Improper Authorization in Kimai Project, Customer, and Activity Rate Edit Endpoints Allows Cross-Scope Rate Manipulation

Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/project/id/rate/rate, /en/admin/customer/id/rate/rate, and /en/admin/activity/id/rate/rate independently resolve the authorized parent identifier and the attacker-selected child rate identifier...

CVE-2026-52825 Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/id/members/userId and POST /api/teams/id/activities/activityId verify that a teamlead may edit the Team but do not verify accessuser for the referenced User or view access for the referenced Activity. A teamlead c...

CVE-2026-52825 Kimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility

Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/id/members/userId and POST /api/teams/id/activities/activityId verify that a teamlead may edit the Team but do not verify accessuser for the referenced User or view access for the referenced Activity. A teamlead c...

PT-2026-92592

Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager component: Core. The supported version that is affected is 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Enterprise...

PT-2026-92629

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Oracle Forms version 12.2.1.19.0 Oracle Fusion Middleware Oracle Forms version 14.1.2.0.0 Description An issue exists in the Forms Services, C/S, Charmode component of Oracle Forms. An unauthenticated attacker with...

PT-2026-93077

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Application Server. The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. While the vulnerability...

PT-2026-92486

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

PT-2026-92494

Name of the Vulnerable Software and Affected Versions Oracle Access Manager versions 12.2.1.4.0 Oracle Access Manager versions 14.1.2.1.0 Description A flaw in the Authentication Engine component allows a high privileged attacker with network access via HTTP to compromise the system. Successful...

EUVD-2026-78812

SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve...

CVE-2026-88620

SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve...

PT-2026-92487

Name of the Vulnerable Software and Affected Versions Oracle Access Manager versions 12.2.1.4.0 Oracle Access Manager versions 14.1.2.1.0 Description A flaw in the Authentication Engine component allows a high privileged attacker with network access via HTTP to compromise the system. This issue c...

PT-2026-92984

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle HRMS India versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of Oracle HRMS India. A low privileged attacker with network access via HTTP can compromise the system,...

PT-2026-92719

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM versions 17.0 through 26.7 Description A flaw in the Server Infrastructure component of the Siebel CRM Deployment product allows a high privileged attacker with network access via HTTP to compromise the system. Successful...

PT-2026-92546

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware component: Client Bundle. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication...

PT-2026-92567

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Portal version 12.2.1.4.0 Oracle WebCenter Portal version 14.1.2.0.0 Description An issue exists in the Composer component of Oracle WebCenter Portal. An unauthenticated attacker with network access via HTTP can compromise the...

PT-2026-92947

Name of the Vulnerable Software and Affected Versions Oracle iRecruitment versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle iRecruitment product of Oracle E-Business Suite. A low privileged attacker with network access via HTTP can...

PT-2026-92835

Name of the Vulnerable Software and Affected Versions Oracle BI Publisher version 8.2.0.0.0 Oracle BI Publisher version 12.2.1.4.0 Oracle BI Publisher version 26.01.0.0.0 Description A flaw in the BI Platform Security component allows a low privileged attacker with network access via HTTP to...

PT-2026-92521

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware component: Messaging Enabler. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Servi...

PT-2026-93102

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.16 Description A flaw in the Core component allows a high privileged attacker with access to the infrastructure where the software executes to compromise the system. This can lead to a complete Denial of Servic...