Oracle GoldenGate 23.x < 23.26.4.0.0 (October 2026 CPU)

The 23.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in Oracle GoldenGate component: Admin Server Executable. Supported versions that are affected are 23.4-23.26.3.0.0. Easily exploitabl...

Oracle GoldenGate 21.x < 21.24.0.0.0 (October 2026 CPU)

The 21.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in Oracle GoldenGate component: Admin Server Executable. Supported versions that are affected are 21.3-21.23. Easily exploitable...

Oracle GoldenGate 19.x < 19.33.0.0.261020 (October 2026 CPU)

The 19.x version of GoldenGate installed on the remote host is affected by multiple vulnerabilities as referenced in the October 2026 CPU advisory. - Vulnerability in Oracle GoldenGate component: Admin Server Executable. Supported versions that are affected are 19.1.0.0.0-19.32.0.0. Easily...

EUVD-2026-106775

Vulnerability in Oracle GoldenGate component: Vendor Access Module. Supported versions that are affected are 19.1.0.0.0-19.32.0.0, 21.3-21.23 and 23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to...

EUVD-2026-106009

Vulnerability in Oracle GoldenGate component: Vendor Access Module. Supported versions that are affected are 21.3-21.23. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate. Successful...

CVE-2026-91547

Vulnerability in Oracle GoldenGate component: Vendor Access Module. Supported versions that are affected are 19.1.0.0.0-19.32.0.0, 21.3-21.23 and 23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to...

CVE-2026-101601

Vulnerability in Oracle GoldenGate component: Vendor Access Module. Supported versions that are affected are 21.3-21.23. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate. Successful...

CVE-2026-91547

A vulnerability exists in the Vendor Access Module component of Oracle GoldenGate . Affected versions include 19.1.0.0.0-19.32.0.0 , 21.3-21.23 , and 23.4-23.26.3.0.0 . A low privileged attacker with logon access to the infrastructure where Oracle GoldenGate executes can easily exploit this flaw ...

CVE-2026-101601

A vulnerability exists in the Vendor Access Module component of Oracle GoldenGate , affecting supported versions 21.3-21.23 . A low-privileged attacker with local access to the infrastructure where the software executes can exploit this vulnerability to compromise Oracle GoldenGate. Successful ex...

PT-2026-120052

Vulnerability in Oracle GoldenGate component: Vendor Access Module. Supported versions that are affected are 19.1.0.0.0-19.32.0.0, 21.3-21.23 and 23.4-23.26.3.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to...

PT-2026-119281

Vulnerability in Oracle GoldenGate component: Vendor Access Module. Supported versions that are affected are 21.3-21.23. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle GoldenGate executes to compromise Oracle GoldenGate. Successful...

Oracle GoldenGate security vulnerabilities

A security vulnerability exists in Oracle GoldenGate versions 21.3 through 21.23. This vulnerability stems from issues within the Vendor Access Module component and may allow low-privilege attackers to log in to Oracle GoldenGate Infrastructure, thereby gaining unauthorized access to critical dat...

Oracle GoldenGate security vulnerabilities

Oracle GoldenGate versions 19.1.0.0.0 to 19.32.0.0.0, 21.3 to 21.23, and 23.4 to 23.26.3.0.0 contain security vulnerabilities. These vulnerabilities are due to issues with the Vendor Access Module component. They may allow low-privilege attackers to log into Oracle GoldenGate and access the...

CVE-2026-81427

The WC Vendors WordPress plugin (versions before 2.7.2.1 ) contains a Missing Authorization vulnerability. The plugin fails to verify that a vendor owns the referenced order when submitting a shipment status change from the front-end. This allows any authenticated vendor to modify another vendor'...

CVE-2026-81427 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...

CVE-2026-81428 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR

The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variations belonging to other vendors, and to change the status and title of arbitra...

PT-2026-84634

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...

WordPress Dokan plugin < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint vulnerability

Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Dokan versions 5.0.11...

CVE-2026-49222 Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/productquestion.sql queries...

CVE-2026-49222 Vvveb product question authorization bypass allows Vendors to read, approve, edit, or delete questions under other Vendors' products

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/productquestion.sql queries...