CVE-2026-71074

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. Supported versions that are affected are 1.0.0-1.4.19 and 3.0.0-3.2.17. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successfu...

EUVD-2026-62009

Vulnerability in the Portable Clusterware component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the...

EUVD-2026-61958

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Experience Manager. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

EUVD-2026-61699

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion component: Server. The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial...

EUVD-2026-61677

Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle...

EUVD-2026-61540

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion component: Installation and Configuration. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise...

EUVD-2026-61341

Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware component: OID LDAP Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle...

EUVD-2026-61315

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-66046

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...

EUVD-2026-60569

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handlefileupload function. This is due to insufficient file type validation in handlefileupload, where the dangerous-extension blocklist performs exact-key matchin...

PT-2026-77441

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Enterprise Capture version 12.2.1.4.0 Oracle WebCenter Enterprise Capture version 14.1.2.0.0 Description An issue exists in the Client Bundle component of Oracle WebCenter Enterprise Capture. An unauthenticated attacker with...

PT-2026-77743

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Financial Reporting version 11.2.25.0.000 Description An issue in the Server component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a full takeove...

PT-2026-77378

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM End User versions 17.0 through 26.6 Description A flaw exists in the Search component of the Oracle Siebel CRM End User product. An unauthenticated attacker with access to the physical communication segment attached to the...

PT-2026-78242

Name of the Vulnerable Software and Affected Versions Confluence Data Center and Server versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 Description A stored Cross-Site Scripting XSS, privilege escalation, and...

PT-2026-77399

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 Description A flaw in the Integration Broker component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful...

PT-2026-78225

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon version 4.5.0 Description A flaw in the Imperative Web Server component allows an unauthenticated attacker with network access via HTTP/2 to compromise the system. This can lead to a complete Denial of Service...

PT-2026-78069

Name of the Vulnerable Software and Affected Versions Oracle Agile PLM MCAD Connector version 3.6 Description An issue exists in the CAX Client component of the Oracle Agile PLM MCAD Connector. An unauthenticated attacker with access to the physical communication segment attached to the hardware...

PT-2026-78100

Name of the Vulnerable Software and Affected Versions Oracle VM VirtualBox version 7.2.14 Description An issue exists in the Core component of Oracle VM VirtualBox. An unauthenticated attacker with network access via RDP can exploit this flaw to cause a hang or a frequently repeatable crash,...

CVE-2026-75081

A vulnerability was detected in Webkul Bagisto up to 2.4.4. Impacted is an unknown function of the file /customer/account/rma/store. The manipulation of the argument rmaqty/resolutiontype/rmareasonid results in enforcement of behavioral workflow. The attack may be performed from remote. The explo...

CVE-2026-40506

OpenEMR before 8.2.0 is vulnerable: the db GET parameter in standard_tables_manage.php is passed unsanitized to temp_dir_cleanup(), allowing path traversal and recursive deletion of arbitrary directories. Chaining with an open redirect in dicom_frame.php enables an unauthenticated attacker to tri...