PT-2026-62543

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware WebCenter Content: Imaging version 12.2.1.4.0 Oracle Fusion Middleware WebCenter Content: Imaging version 14.1.2.0.0 Description A flaw in the Core component allows a low privileged attacker with network access via HTT...

PT-2026-62844

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Work in Process versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Work in Process product. A high privileged attacker with access to the infrastructure...

PT-2026-62544

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware WebCenter Content: Imaging version 12.2.1.4.0 Oracle Fusion Middleware WebCenter Content: Imaging version 14.1.2.0.0 Description A flaw in the Core component allows a low privileged attacker with network access via HTT...

PT-2026-62696

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description An issue exists in the Content Server component of Oracle Fusion Middleware. This flaw allows an unauthenticated attacker with network access v...

PT-2026-62097

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authenticated low-privileged user can cause a denial of service by exploiting uncontrolled resource consumption within the Canvas functionality. By sending a specially crafted request, the...

PT-2026-62599

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Sites version 12.2.1.4.0 Oracle WebCenter Sites version 14.1.2.0.0 Description An issue in the Oracle WebCenter Sites component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via HTTP to...

PT-2026-62124

The CONFIG USERSPACE syscall verifier z vrfy k poll in kernel/poll.c allocates a kernel-side copy of the user-supplied k poll event via z thread malloc and then validates each event's object handle. Before this fix, validation used K OOPSK SYSCALL OBJ... inline inside the loop, which kills the...

PT-2026-63300

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A user who previously had access to a private repository can continue to obtain repository metadata after their access has been revoked. While direct access to the repository is correctly denie...

PT-2026-63276

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.27.0 Description An authenticated user can cause a denial of service by sending a large HTTP request to the NPM package tag API endpoint. The AddPackageTag function reads the entire request body into memory using...

PT-2026-63301

Name of the Vulnerable Software and Affected Versions Gitea version 1.25.5 Description An insufficient authorization issue exists in the LFS server where the system uses the UserID embedded in an LFS JWT to make cross-repository authorization decisions via the LFSObjectAccessible function. When a...

PT-2026-62037

Name of the Vulnerable Software and Affected Versions AOS-CX affected versions not specified Description Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. A remote high-privileged user could exploit these issues to execute arbitrary code as a privileged user on the...

PT-2026-62246

Name of the Vulnerable Software and Affected Versions Oracle Java SE version 8u491 openjfx versions prior to 17.0.20.0-1.1 Description An issue in the JavaFX component allows an unauthenticated attacker with network access to compromise the system. Successful exploitation requires human interacti...

PT-2026-62970

Name of the Vulnerable Software and Affected Versions Oracle MySQL Connector/J versions 9.7.0 through 9.7.1 Description An unauthenticated attacker with network access via multiple protocols can compromise MySQL Connectors. This issue requires human interaction from a person other than the attack...

PT-2026-63264

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description An authorization bypass occurs when user-controlled keys are used, allowing an attacker to disclose information. This happens via user-supplied identifiers that reference scheduled query resul...

PT-2026-63284

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authenticated user can cause a denial of service by submitting a specially crafted RFC 4716 SSH2 public key to the SSH key ingestion endpoint. The issue stems from a normalization function...

PT-2026-63074

Name of the Vulnerable Software and Affected Versions Oracle Agile Engineering Data Management version 6.2.1 Description A flaw in the Install component allows a low privileged attacker with network access via HTTP to compromise the system. Exploitation is difficult and requires human interaction...

PT-2026-62165

Name of the Vulnerable Software and Affected Versions Oracle Enterprise Manager Base Platform version 24.1 Description A flaw in the Security Framework component allows a low privileged attacker with network access via HTTPS to compromise the platform. The attack requires human interaction from a...

PT-2026-62695

Name of the Vulnerable Software and Affected Versions Oracle WebCenter Content version 12.2.1.4.0 Oracle WebCenter Content version 14.1.2.0.0 Description An issue exists in the Content Server component of Oracle WebCenter Content. A low privileged attacker with network access via HTTP can...

PT-2026-63286

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The Debian package registry parser contains two issues that can lead to a complete denial of service. First, an unbounded decompression flaw exists in the ParseControlFile function. When...

CVE-2025-66390

In Microsoft Azure API Management through 2025-10-17, when self-service signup username/password Basic Authentication is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI...