EUVD-2026-79902

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial...

CVE-2026-87216

CVE-2026-87216 affects the Security component of Oracle Hyperion Financial Management version 11.2.26.0.000 . The vulnerability is easily exploitable by a low-privileged attacker who has logon to the infrastructure where the product executes. Successful exploitation results in full takeover of th...

CVE-2026-87180

Oracle Hyperion Financial Management version 11.2.26.0.000 is affected by a vulnerability in the Security component. A low-privileged attacker with network access via HTTP can exploit this vulnerability with low complexity and no user interaction to achieve full takeover of the system, with high ...

EUVD-2026-79721

Vulnerability in the PeopleSoft Enterprise FIN Engineering Brazil product of Oracle PeopleSoft component: Engineering. The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN...

EUVD-2026-79706

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware component: Content Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle WebCenter...

CVE-2026-83257

CVE-2026-83257 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge ), version 11.4.0 . A low-privileged attacker with network access via HTTP can exploit this vulnerability to achieve full takeover of the affected product. The attack is rated difficult to ...

CVE-2026-83255

Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge ), version 11.4.0 , is affected by a vulnerability that allows an unauthenticated attacker with network access via TCP to achieve takeover of the product. The attack is rated as difficult to exploit (high complex...

EUVD-2026-79605

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Endeca Application Controller. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with logon to the...

CVE-2026-83238

CVE-2026-83238 affects Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Forge ), version 11.4.0 . The vulnerability is easily exploitable by a low-privileged attacker with network access via HTTP , requiring no user interaction. Successful exploitation can lead to un...

CVE-2026-83235

Oracle Commerce Guided Search / Oracle Commerce Experience Manager (component: Experience Manager , version 11.4.0 ) is affected by an easily exploitable vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise the product. Successful exploitation results i...

CVE-2026-83236

A high-severity (CVSS 3.1 score 8.2 ) vulnerability exists in Oracle Commerce Guided Search / Experience Manager version 11.4.0 (component: Experience Manager). An unauthenticated attacker with network access via HTTP can exploit this with low complexity, though human interaction from a non-attac...

EUVD-2026-79474

Vulnerability in the PeopleSoft Enterprise FIN Inventory Brazil product of Oracle PeopleSoft component: Inventory. The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN...

CVE-2026-83018

CVE-2026-83018 affects Oracle PeopleSoft Enterprise PeopleTools in the SQR component, with supported versions 8.61 through 8.63 vulnerable. A low-privileged attacker with local logon to the infrastructure where PeopleTools executes can exploit this vulnerability with low complexity and no user in...

CVE-2026-39040

BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting XSS via the component Trufflebox UI trufflebox-ui in ExpressionViewModal.jsx...

ROOT-APP-NPM-CVE-2023-45133 CVE-2023-45133 in babel-traverse - Patched by Root

Root has patched CVE-2023-45133 in the babel-traverse package for Root:npm. Multiple fixed versions available...

EUVD-2026-78891

Bugsink is a self-hosted error tracking tool. Prior to version 2.2.2, Bugsink stores every set of custom tags supplied with an incoming event, allowing a caller with a valid project DSN to submit an unusually large tag set and force excessive tag-row writes. Because Bugsink uses a single-writer...

EUVD-2026-78936

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended access and can lead to the exposure of resource...

CVE-2026-21587

This High severity Improper Authorization vulnerability was introduced in version 11.3.0 of Jira Service Management Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.1, allows an authenticated attacker to gain unintended access and can lead to the exposure of resource...

WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Devlin Jenkins in WordPress Plugin TrueBooker versions = 1.2.3...

CVE-2026-91991

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to setcookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or...