PT-2026-119645

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Enterprise Infrastructure SEC. Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD...

PT-2026-118250

ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory...

PT-2026-118655

A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

PT-2026-119828

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Monitoring and Diagnostics SEC. Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD...

PT-2026-118334

react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's...

PT-2026-118794

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description A use after free issue exists in the FileSystem component. This flaw allows a remote attacker to potentially execute arbitrary code within the sandbox by inducing the user to visit a...

PT-2026-119950

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Server Infrastructure. Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment...

PT-2026-118723

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 156.0.8078.47 Description Memory corruption occurs in the PDF component, which may allow a remote attacker to read memory within the sandbox by using a specially crafted HTML page. Recommendations...

PT-2026-119563

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite component: Workflow Events. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping...

PT-2026-119073

Vulnerability in Oracle REST Data Services component: Core. Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can...

PT-2026-119657

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: EAI. Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks...

PT-2026-119306

Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Net. The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attack...

PT-2026-119900

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud...

PT-2026-118659

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated...

PT-2026-119810

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Web Runtime SEC. Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards...

PT-2026-118699

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption in the Transactions Platform allows a remote attacker to potentially read memory inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome ...

PT-2026-118761

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption occurs in the OptimizationGuide component, which could allow a remote attacker to potentially execute arbitrary code within the sandbox by inducing the user to visit a...

PT-2026-118762

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description A use after free issue exists in the Media component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote attack...

PT-2026-118763

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption in Fonts allows a remote attacker to read memory inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome to version 156.0.8078.47 or late...

PT-2026-118822

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption in DevTools allows a remote attacker to execute arbitrary code inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-118823

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption occurs in the PolicyContainer, which could allow a remote attacker to execute arbitrary code outside the sandbox by inducing the user to visit a specially crafted HTML...

PT-2026-118824

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption in the Browser component allows a remote attacker to potentially execute arbitrary code inside the sandbox by inducing the user to visit a crafted HTML page...

PT-2026-118825

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Missing authorization in the Animation component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded...

PT-2026-118826

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Improper access control in Extensions allows a remote attacker to potentially leak sensitive information through the use of a crafted HTML page. Recommendations Update Google Chrome to...

PT-2026-118827

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description A use after free issue exists in the Actor component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote attack...

PT-2026-118828

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption in the Bluetooth component allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page...

PT-2026-118448

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.34.0 Description The application contains an issue where the endpoint 'POST /api/v1/@apostrophecms/doc/slugTaken' does not implement permission or type filters when processing the slug variable in the request...

PT-2026-119241

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite component: PO View Document. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful...

PT-2026-118495

Name of the Vulnerable Software and Affected Versions sanitize-html version 2.18.0 Description In the sanitize-html library, a recursive call to the sanitizeHtmltext, options function occurs when an tag is not permitted and the disallowedTagsMode is set to 'discard'. Because this recursion lacks ...

PT-2026-118351

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on a...

PT-2026-119648

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Enterprise Infrastructure SEC. Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards...

PT-2026-118293

Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core...

PT-2026-119385

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Payroll versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Payroll product. A low privileged attacker with network access via HTTP can compromise the...

PT-2026-120060

Vulnerability in the PeopleSoft Enterprise FIN Manufacturing Brazil product of Oracle PeopleSoft component: Integration. The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN...

PT-2026-119313

Vulnerability in the MySQL Router product of Oracle MySQL component: Router: General. The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise MySQL Router. Successful attacks of this vulnerabilit...

PT-2026-117944

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to bypass Privacy preferences...

PT-2026-119295

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability...

PT-2026-118322

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

PT-2026-120092

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications component: BRM Server. Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon ...

PT-2026-120118

Vulnerability in Oracle Essbase component: Security. The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized...

PT-2026-118258

A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS...

PT-2026-117963

An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network file server may be able to cause unexpected system termination...

PT-2026-119269

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications component: System Wide. Supported versions that are affected are 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.10 and 25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated...

PT-2026-118330

OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any...

PT-2026-119607

Vulnerability in Oracle Java SE component: Compiler. Supported versions that are affected are Oracle Java SE: 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this...

PT-2026-119278

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle V...

PT-2026-118333

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent and onDeleteEvent that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user...

PT-2026-120894

These are all security issues fixed in the cups-2.4.20-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-119225

Vulnerability in the Oracle Capacity product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity. Successful...

PT-2026-119202

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications component: System Wide. Supported versions that are affected are 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.18, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and...