PT-2026-118390

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0...

PT-2026-118363

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...

PT-2026-120322

Summary In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server its audience. Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server. Am I...

PT-2026-119755

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware component: Fabric Layer. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite...

PT-2026-118367

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 158.0.1 Thunderbird versions prior to 158.0.1 Description An issue exists involving uninitialized memory within the Audio/Video: cubeb component. Recommendations Update Firefox to version 158.0.1 or later. Update...

PT-2026-119528

Name of the Vulnerable Software and Affected Versions Moov signedxml versions prior to 1.4.1 Description An issue exists in the ExclusiveCanonicalization function within exclusivecanonicalization.go where the accumulated namespace map is copied at every nested element before reference digest or...

PT-2026-118347

A flaw was found in cockpit-machines. When saving Virtual Network Computing VNC console settings, the configured password is passed directly as a command-line argument to an underlying system utility. A local unprivileged attacker on a host that allows cross-user process inspection could read the...

PT-2026-119560

Vulnerability in the Oracle HRMS Republic of Korea product of Oracle E-Business Suite component: Korean Payroll. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle HRMS Republic...

PT-2026-119769

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware component: Fabric Layer. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite...

PT-2026-118491

A flaw has been found in aaPanel up to 8.25.0. Impacted is the function send file of the file BTPanel/routes/v2.py of the component Download Endpoint. Executing a manipulation of the argument filename can lead to path traversal. The attack can be executed remotely. The exploit has been published...

PT-2026-117960

A privacy issue was addressed with improved access restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to access sensitive user data...

PT-2026-119715

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Core. The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In...

PT-2026-119193

Vulnerability in Oracle Trusted Answer Search component: Application expert UI. The supported version that is affected is 26.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Trusted Answer Search. While the vulnerability is in...

PT-2026-119546

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Process Scheduler. Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft...

PT-2026-119563

Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite component: Workflow Events. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Shipping...

PT-2026-118384

Name of the Vulnerable Software and Affected Versions filelock versions 4.1.0 through 4.2.0 Description In the SoftFileLock implementation, a stale observation can be reused. This occurs when an attacker pre-dates and removes their own marker while at least two lock-user processes are waiting. If...

PT-2026-119930

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management product of Oracle Construction and Engineering component: Web Access. Supported versions that are affected are 21.12.0.0-21.12.21.9, 22.12.0.0-22.12.21.4, 23.12.0-23.12.20, 24.12.0-24.12.16 and 25.12.0-25.12.8. Easily...

PT-2026-118649

Name of the Vulnerable Software and Affected Versions @fastify/middie versions 9.0.0 through 9.3.5 Description The use function joins a path-scoped middleware mount path to the plugin scope prefix in a manner that may diverge from the path served by the Fastify router. This occurs primarily when...

PT-2026-119479

Name of the Vulnerable Software and Affected Versions Oracle MySQL Connector/ODBC version 26.7.1 Description A flaw in the MySQL Connectors product allows a low-privileged attacker with network access via multiple protocols to compromise the system. Successful exploitation can lead to unauthorize...

PT-2026-120028

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain component: Product Quality Management. The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to...

PT-2026-119462

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable...

PT-2026-119873

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Clean Content SDK. The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outsid...

PT-2026-119923

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM versions 17.0 through 26.9 Description An issue exists in the Open UI component of the Siebel CRM End User product. An unauthenticated attacker with network access via HTTP can compromise the system, potentially leading to...

PT-2026-119911

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Utility. Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1...

PT-2026-119547

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Meta Data. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

PT-2026-119939

Vulnerability in Oracle Java SE component: Libraries. Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Easily exploitable...

PT-2026-119196

Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows high privileged attacker having None privilege with logon to the infrastructure where Oracle Ne...

PT-2026-120301

Summary launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. Impact Only apps that match all of the following conditions are affected: - The user uses Windows - An...

PT-2026-118432

gx multi line text view display info get reads one byte past the end of the application's text buffer when the string it is given ends with a carriage return r. The over-read can also cause callers to advance their index past the end of the string, producing a second over-read in gx multi line te...

PT-2026-119657

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM component: EAI. Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks...

PT-2026-119905

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serviceability. Supported versions that are affected are Oracle Java SE: 8u503, 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK:...

PT-2026-119888

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite component: Transaction Entry. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order...

PT-2026-119356

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications component: Platform. Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with netwo...

PT-2026-119870

Vulnerability in the iSupport product of Oracle E-Business Suite component: Service Requests. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise iSupport. Successful attacks of this...

PT-2026-118371

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the wTotalLength field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the...

PT-2026-119173

Vulnerability in Oracle Autonomous Health Framework component: Trace File Analyzer. Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise...

PT-2026-119286

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications component: BRM Server. Supported versions that are affected are 15.0.0.0.0, 15.0.1.0.0, 15.1.0.0.0 and 15.2.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with netwo...

PT-2026-119166

Vulnerability in Oracle Autonomous Health Framework component: Trace File Analyzer. Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise...

PT-2026-119285

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications component: System Wide. Supported versions that are affected are 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.18, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.10 and...

PT-2026-119420

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.4.0 through 8.4.12 MySQL Server versions 9.7.0 through 9.7.3 MySQL Server version 26.7.0 through 26.7.1 MySQL Cluster versions 8.0.0 through 8.0.49 MySQL Cluster versions 8.4.0 through 8.4.12 MySQL Cluster versions 9.7....

PT-2026-118603

Acrobat for Edge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

PT-2026-119656

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

PT-2026-119941

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM component: Open UI. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful attacks of this...

PT-2026-120154

We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP. We can confirm that they're real. CVE-2926-109618/619 We cannot share further information right now. Take this seriously and apply patches when available. https://t.co/kguM8fpq1...

PT-2026-119093

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM component: Marketing. Supported versions that are affected are 17.0-26.9. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel Apps - Marketing. Successful...

PT-2026-118271

30 Advantech ADAM-3600 vulnerabilities, including CVE-2026-43836, allow remote code execution and auth bypass. Update EdgeLink to 2.8.5.0. Advantech ADAM3600 ICS OTSecurity CVE202643836 CVE202643844 RemoteCodeExecution CyberSecurity https://t.co/hTwBJVoyA6...

PT-2026-119891

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud...

PT-2026-118362

Nokia 1830 Global Express GX is vulnerable to a CLI ACL Bypass vulnerability where a low-privileged authenticated attacker can bypass the SSH isolation mechanism and gain access to the underlying operating system shell via a custom SSH command. This issue occurs by default in the system and is no...

PT-2026-119890

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 22.3-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud...

PT-2026-119433

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.4.0 through 8.4.12 MySQL Server versions 9.7.0 through 9.7.3 MySQL Server version 26.7.0 through 26.7.1 MySQL Cluster versions 8.0.0 through 8.0.49 MySQL Cluster versions 8.4.0 through 8.4.12 MySQL Cluster versions 9.7....