PT-2026-119077

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Business Interlink. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterpris...

PT-2026-119098

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 Description A flaw in the Business Interlink component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitati...

PT-2026-119096

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM component: Email Marketing. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful...

PT-2026-119085

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM Siebel Apps - Marketing versions 17.0 through 26.9 Description A flaw in the Marketing component allows a high privileged attacker with network access via HTTP to compromise the system. Successful exploitation can lead to...

PT-2026-119101

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Analytic Server. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

PT-2026-119079

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM component: Marketing. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing. Successful attac...

PT-2026-119097

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Report Distribution. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise...

PT-2026-119100

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Analytic Server. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where PeopleSoft Enterprise...

PT-2026-119102

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Porting. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools...

PT-2026-119078

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft PeopleSoft Enterprise PeopleTools versions 8.61 through 8.63 Description A flaw in the Business Interlink component allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful...

PT-2026-119084

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM component: Marketing. Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Siebel Apps - Marketing executes to compromi...

PT-2026-119103

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Analytic Server. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

PT-2026-119067

Vulnerability in Oracle REST Data Services component: ADP. Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can...

PT-2026-119080

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM component: Marketing. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel Apps - Marketing executes to compromise...

PT-2026-120316

Summary A small attacker-supplied TIFF can be opened and loaded normally, then reach an out-of-bounds read when an application saves it back to TIFF with retained metadata. The fixed reproducer is a 1×1, 16-bit grayscale, PackBits-compressed TIFF containing tag 320 ColorMap with 768 SHORT values:...

PT-2026-118411

gx binres theme load and gx binres font load take the resource as a bare GX UBYTE with no length, and GX BINRES DATA INFO has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declar...

PT-2026-118410

The GUIX binary resource loader never checks that a font page's glyph range is well formed. gx page header first glyph and gx page header last glyph are read verbatim from the file and only the upper bound of last glyph is validated, so a page declaring first glyph last glyph makes last - first +...

PT-2026-118444

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor new term from counted literal caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 25...

PT-2026-118377

A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results in path traversal. It is possible to launch the...

PT-2026-118364

A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This vulnerability affects unknown code of the file /cgi-bin/mainfunction.cgi of the component Apmupload. Performing a manipulation of the argument action results in path traversal. The attack is possible to be carried out...

PT-2026-118378

A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument newtable causes command injection. The attack can be initiate...

PT-2026-118486

Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue...

PT-2026-118469

Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers to bypass zone-based execution protections. Attackers can deliver unsigned PowerShell scripts or modules in downloaded archives that run under the RemoteSigned policy when the...

PT-2026-118460

🚨 CVE-2026-113600 Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete other users' comments because CommentsControllerupdate and destroy use an unscoped Comment.find without authorization checks. Attackers can...

PT-2026-118474

Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that allows resellers to read any admin record via identifier confusion. Attackers can send their own loginname with another admin's numeric id to retrieve contact email, IP allow-lists,...

PT-2026-118453

Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field values from other workspaces via the unique row values API endpoint. Attackers can enumerate sequential field IDs to retrieve up to 100 distinct cell values per field from tables i...

PT-2026-118386

A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launch...

PT-2026-118407

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It...

PT-2026-118430

Name of the Vulnerable Software and Affected Versions Vitest versions 5.0.0-beta.6 through 5.0.4 Description Dev servers may misapply server.fs.deny because project servers replace defaults and the root server adds .vitest-secret-token after the matcher is compiled. An attacker with access to an...

PT-2026-118408

The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second SOF0 frame header after SOS re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns GX SUCCESS and publishes a GX PIXELMAP whos...

PT-2026-118482

Name of the Vulnerable Software and Affected Versions SuggestArr versions prior to 3.0.0 Description An authentication bypass exists in the local bypass authentication mode. The enforce authentication function in api service/auth/middleware.py trusts the request.remote addr value, which is derive...

PT-2026-118468

Configurable Reports block for Moodle moodle-block configurablereports before 5.3.1 contains an sql injection vulnerability in report sql::prepare sql via the filter var request parameter of viewreport.php. Low-privileged users permitted to view reports using the %%FILTER VAR%% placeholder can...

PT-2026-118473

Unpatched vulnerabilities don't stay hidden on our atlas. CVE CRITICAL VULNERABILITY DETECTED CVE ID: CVE-2026-113613 Vendor: Unknown Severity: Critical — CVSS 9.2 Product: Unknown Date: 2026-10-20 A critical vulnerability Path Traversal has been disclosed affecting Unknown. Patch immediately...

PT-2026-118457

Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to read and modify other users' tags by supplying arbitrary tag IDs. Attackers can enumerate sequential IDs via fullTagNameById, updateTagIcon, and updateTagOrder...

PT-2026-118455

🚨 CVE-2026-113595 Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGE SETTINGS permission. Attackers can remove the current logo and replace it with an upload...

PT-2026-118414

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's tx queue message size is a count of ULONGs and the cop...

PT-2026-118505

SolarWinds Observability Self-Hosted was found to be affected by a Server-Side Request Forgery SSRF vulnerability that allows authenticated attackers to cause the application server to send requests to attacker-controlled or internal destinations...

PT-2026-118493

SolarWinds Patch Manager exposes sensitive information accessible to local users, which could be used to gain elevated privileges...

PT-2026-118492

Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.1 Description The API endpoint 'POST /api/v1/@apostrophecms/import-export/clean-export' lacks authentication and authorization checks. This allows unauthenticated anonymous users with a...

PT-2026-118458

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms...

PT-2026-118464

Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unvalidated extended section and program header counts. Attackers can supply a crafted 128-byte ELF file that triggers an OutOfMemoryError during load-spec...

PT-2026-118465

Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent that allows administrators to bypass H2 import restrictions using CREATE OR REPLACE ALIAS. Authenticated administrators can upload a crafted SQL backup to the import-database endpoint, whe...

PT-2026-118476

Name of the Vulnerable Software and Affected Versions Froxlor versions prior to 2.3.15 Description A symlink following issue exists in the Statistics::makeChownWithNewStats function. Authenticated customers can exploit this by replacing the goaccess statistics directory in their document root wit...

PT-2026-118454

Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE SETTINGS permission. Attackers can set a join password, disable registration, zero upload...

PT-2026-118456

Name of the Vulnerable Software and Affected Versions Webstudio versions prior to 0.256.0 Description Authenticated users can access project data belonging to other users due to missing authorization. By knowing a project UUID, an attacker can query the '/trpc' endpoint using the publishedBuilds...

PT-2026-118450

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.34.0 Description A public REST API type utilizing publicApiProjection allows the exposure of excluded searchable or sortable field information. This occurs through search membership and sort ordering oracles,...

PT-2026-118471

Name of the Vulnerable Software and Affected Versions Outline versions prior to 1.8.0 Description An improper access revocation issue exists where deleted administrators continue to receive document contents. This occurs because the UserDeletedProcessor fails to disable WebhookSubscription rows...

PT-2026-118413

The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating...

PT-2026-118423

Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through 5.9.7...

PT-2026-118485

A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue...