127769 matches found
PT-2026-62961
Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft PeopleSoft Enterprise FIN Common Objects Brazil version 9.1 Description A flaw in the Purchasing component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can...
PT-2026-62633
Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft Enterprise FIN Pay/Bill Management version 9.2 Description A flaw in the Paybill Management component allows a low-privileged attacker with access to the infrastructure where the software executes to compromise the system. Th...
PT-2026-62090
Name of the Vulnerable Software and Affected Versions aiflowy versions prior to 2.1.3 Description A Cross Site Scripting XSS issue exists where a remote attacker can obtain sensitive information. The flaw is located within the UploadController.java file. Recommendations Update aiflowy to version...
PT-2026-62635
Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft Enterprise FIN Cash Management version 9.2 Description An issue in the Cash Management component allows an unauthenticated attacker with network access via HTTP to compromise the system. Although the flaw is located within...
PT-2026-62082
Name of the Vulnerable Software and Affected Versions DayuanJiang next-ai-draw-io version 0.4.13 Description A remote attacker can obtain sensitive information through the x-ai-provider component. Recommendations At the moment, there is no information about a newer version that contains a fix for...
PT-2026-63313
Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The ToHook function in services/webhook/general.go decrypts the HeaderAuthorizationEncrypted field and returns the plaintext authorization header in the API response. This allows repository...
PT-2026-63261
Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description Missing authorization allows a user with limited feature privileges to access workflow execution outputs within their Kibana space. This occurs because the documented API does not properly...
CVE-2026-50755
An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header value...
PT-2026-63174
Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Order Management versions 12.2.4 through 12.2.15 Description A flaw in the Product Diagnostic Tools component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead ...
PT-2026-62039
Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database. SQL injecti...
PT-2026-62081
Name of the Vulnerable Software and Affected Versions DayuanJiang next-ai-draw-io version 0.4.13 Description A remote attacker can obtain sensitive information by manipulating the X-Forwarded-For header value. Recommendations At the moment, there is no information about a newer version that...
Improper Removal of Sensitive Information Before Storage or Transfer
Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the RedirectMiddleware process. An attacker can access sensitive information included in URI fragments by controlling the redirect destination and inspecting the...
CVE-2026-51031
FlareSolverr before version 3.4.7 contains a server-side request forgery SSRF vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information...
Composer: Path traversal in package bin field lets dependencies chmod arbitrary host files
Summary A Composer package declares its executables in the bin field of its composer.json. When Composer installs a package, it processes each bin entry and changes the file mode of the corresponding file so it is executable. If a bin entry contains .. path segments, it can resolve to a path...
webkitgtk: webkitgtk: Visiting a website may leak sensitive data
A flaw was found in WebKitGTK. Visiting a website can leak sensitive data due to a permissions issue that was addressed with additional restrictions...
webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information
A flaw was found in WebKitGTK. Processing maliciously crafted web content can disclose sensitive user information due to a path handling issue that was addressed with improved validation...
CVE-2026-63769 Huginn 2022.08.18 SSRF via ScenarioImport fetch_url Method
Huginn through 2022.08.18 contains a server-side request forgery vulnerability in the fetchurl method of ScenarioImport that allows authenticated users to make arbitrary HTTP requests by submitting crafted URLs. Attackers can probe internal network services, enumerate ports via error signatures,...
webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information
A flaw was found in WebKitGTK. Processing maliciously crafted web content can disclose sensitive user information due to a path handling issue that was addressed with improved validation...
webkitgtk: webkitgtk: Visiting a website may leak sensitive data
A flaw was found in WebKitGTK. Visiting a website can leak sensitive data due to a permissions issue that was addressed with additional restrictions...