CVE-2026-60780: Improper Access Control

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise Oracle Workflow. Successfu...

CVE-2026-60542: Improper Access Control

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware component: Human Workflow. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to...

CVE-2026-60149: Improper Access Control

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Workflow...

CVE-2026-60144: Improper Access Control

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Workflow execut...

Tool-Guided Retrieval-Augmented Repair for Securing LLM-Generated C Code

Large language models can generate C code from natural-language descriptions, but resulting programs often contain security vulnerabilities and compilation errors, posing risks for embedded and resource-constrained systems. This work investigates how feedback and retrieval improve reliability of...

PT-2026-63136

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Workflow versions 12.2.3 through 12.2.15 Description A flaw in the Workflow Notification Mailer component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to...

PT-2026-63227

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Workflow versions 12.2.3 through 12.2.15 Description A flaw exists in the Workflow Notification Mailer component of the Oracle Workflow product. This issue allows an unauthenticated attacker with network access v...

PT-2026-62617

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Workflow versions 12.2.3 through 12.2.15 Description A flaw in the Workflow Notification Mailer component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to...

PT-2026-61835

The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations...

PT-2026-63114

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Workflow versions 12.2.3 through 12.2.15 Description A flaw in the Workflow Notification Mailer component allows an unauthenticated attacker with network access via SMTP to compromise the system. Successful...

PT-2026-62776

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Workflow versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Workflow product. An unauthenticated attacker with network access via SMTP can compromise th...

CVE-2026-63143: Missing Authorization

Missing Authorization CWE-862 in Kibana can lead to unauthorized information disclosure via Privilege Abuse CAPEC-122. A user with limited feature privileges can access workflow execution outputs in their Kibana space without the authorization required to do so through the documented API. The...

CVE-2026-13694: Missing Authorization

The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations...

CVE-2026-60143: Improper Access Control

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Workflow...

PT-2026-62584

Name of the Vulnerable Software and Affected Versions Oracle Business Process Management Suite version 12.2.1.4.0 Oracle Business Process Management Suite version 14.1.2.0.0 Description A flaw in the Human Workflow component of the Oracle Business Process Management Suite allows a low privileged...

GHSA-X756-G4X3-C64M Cloudreve: Non-admin remote download users can SSRF loopback/internal services and read imported responses

Summary Cloudreve's remote download workflow accepts user-supplied URLs and passes them to the configured downloader without blocking loopback, localhost, IPv6 localhost, or redirect-to-loopback targets. When the remote download permission is granted to a non-admin user group, a normal...

CVE-2026-32824 dataCycle User API Password Reset And Confirmation Flows Trust Attacker- Controlled Redirect Targets

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, a low-privileged authenticated API user can supply forwardToUrl and...

Improper Isolation or Compartmentalization

Overview org.apache.syncope.ext.flowable:syncope-ext-flowable-bpmn is an Open Source system for managing digital identities in enterprise environments, Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization via the processEngineConfiguration setup in...

Incorrect Privilege Assignment

Overview Affected versions of this package are vulnerable to Incorrect Privilege Assignment through the user self-service workflow handling in UserSelfLogic, UserCR/UserUR, and DefaultUserWorkflowAdapter. An attacker can grant themselves defined roles and their entitlements by submitting a...

CVE-2026-62183 Apache Syncope: User self-service privilege escalation

Improper Privilege Management vulnerability in Apache Syncope. When: the all-Java user workflow adapter is configured, or the Flowable user workflow adapter is configured, bearing a BPMN definition not requiring admin approval for user self registration of self update requests the following...