PT-2026-119306

Vulnerability in the MySQL Connectors product of Oracle MySQL component: Connector/Net. The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attack...

PT-2026-119900

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud...

PT-2026-118659

Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated...

PT-2026-119810

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Web Runtime SEC. Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards...

PT-2026-118375

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M25 through 11.0.26 Description A buffer under-read occurs in the HTTP/1.1 non-blocking write path. This issue allows a large response body to be split between the current request and the subsequent request receiv...

PT-2026-118699

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption in the Transactions Platform allows a remote attacker to potentially read memory inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome ...

PT-2026-118761

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption occurs in the OptimizationGuide component, which could allow a remote attacker to potentially execute arbitrary code within the sandbox by inducing the user to visit a...

PT-2026-118762

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description A use after free issue exists in the Media component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote attack...

PT-2026-118763

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption in Fonts allows a remote attacker to read memory inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome to version 156.0.8078.47 or late...

PT-2026-118822

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption in DevTools allows a remote attacker to execute arbitrary code inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-118823

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption occurs in the PolicyContainer, which could allow a remote attacker to execute arbitrary code outside the sandbox by inducing the user to visit a specially crafted HTML...

PT-2026-118824

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption in the Browser component allows a remote attacker to potentially execute arbitrary code inside the sandbox by inducing the user to visit a crafted HTML page...

PT-2026-118825

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Missing authorization in the Animation component allows a remote attacker to bypass the web origin policy, which is a security mechanism that restricts how a document or script loaded...

PT-2026-118826

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Improper access control in Extensions allows a remote attacker to potentially leak sensitive information through the use of a crafted HTML page. Recommendations Update Google Chrome to...

PT-2026-118827

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description A use after free issue exists in the Actor component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote attack...

PT-2026-118828

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption in the Bluetooth component allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted HTML page...

PT-2026-118448

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.34.0 Description The application contains an issue where the endpoint 'POST /api/v1/@apostrophecms/doc/slugTaken' does not implement permission or type filters when processing the slug variable in the request...

PT-2026-119241

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite component: PO View Document. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful...

PT-2026-118495

Name of the Vulnerable Software and Affected Versions sanitize-html version 2.18.0 Description In the sanitize-html library, a recursive call to the sanitizeHtmltext, options function occurs when an tag is not permitted and the disallowedTagsMode is set to 'discard'. Because this recursion lacks ...

PT-2026-118351

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on a...

PT-2026-119545

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Search Framework. The supported version that is affected is 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise...

PT-2026-119648

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Enterprise Infrastructure SEC. Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards...

PT-2026-118293

Pinning a CA certificate via pinnedPeerCertSha256 can lead to the success of MITM attacks in github.com/xtls/xray-core...

PT-2026-119385

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Payroll versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Payroll product. A low privileged attacker with network access via HTTP can compromise the...

PT-2026-120060

Vulnerability in the PeopleSoft Enterprise FIN Manufacturing Brazil product of Oracle PeopleSoft component: Integration. The supported version that is affected is 9.1. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise FIN...

PT-2026-119313

Vulnerability in the MySQL Router product of Oracle MySQL component: Router: General. The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise MySQL Router. Successful attacks of this vulnerabilit...

PT-2026-117944

A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A malicious application may be able to bypass Privacy preferences...

PT-2026-118601

A Stored Cross-Site Scripting vulnerability exists in the SNS enrollment Portal. Through the captive portal an attacker can inject an XSS when requesting user creation. The stored XSS can only be triggered during validation by the administrator...

PT-2026-118602

Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must visit a maliciously...

PT-2026-119295

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability...

PT-2026-118322

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service...

PT-2026-120092

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications component: BRM Server. Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows low privileged attacker with logon ...

PT-2026-118512

Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.0 Description An authenticated user with import privileges can cause a denial of service by uploading a specially crafted tar archive. The issue exists because the system uses a literal...

PT-2026-120122

Name of the Vulnerable Software and Affected Versions Oracle Essbase version 21.8.3.0.0 Description A security flaw in the Security component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to a full takeover of the software...

PT-2026-120118

Vulnerability in Oracle Essbase component: Security. The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in unauthorized...

PT-2026-118258

A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and license files.It is necessary to use only the MyStormshield servers to retrieve update files or licenses, or to use automatic verification via SNS...

PT-2026-117963

An integer underflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker with control of a network file server may be able to cause unexpected system termination...

PT-2026-119269

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications component: System Wide. Supported versions that are affected are 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.10 and 25.12.0.0.0-25.12.0.0.2. Easily exploitable vulnerability allows unauthenticated...

PT-2026-119129

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the...

PT-2026-119887

Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Switzerland product of Oracle PeopleSoft component: Global Payroll for Switzerland. The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where...

PT-2026-118330

OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListName.php, deleteList.php, or addToLists.php with any...

PT-2026-119322

Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager...

PT-2026-119607

Vulnerability in Oracle Java SE component: Compiler. Supported versions that are affected are Oracle Java SE: 25.0.4.1 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this...

PT-2026-119917

Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards component: E1 IOT Orchestrator Security. Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication...

PT-2026-119278

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.2.20. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle V...

PT-2026-118333

OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent and onDeleteEvent that allows authenticated users to modify or delete other users' calendar events. Attackers with EDIT or DELETE access can supply arbitrary eventID values to alter or remove any user...

PT-2026-120894

These are all security issues fixed in the cups-2.4.20-1.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-119225

Vulnerability in the Oracle Capacity product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Capacity. Successful...

PT-2026-119202

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications component: System Wide. Supported versions that are affected are 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.18, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and...

PT-2026-118257

The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is enabled. This oversight allows an attacker to repeatedly attempt password guesses for a user account without being adequately restricted. Exploiting this...