PT-2026-119876

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Clean Content SDK. The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outsid...

PT-2026-119683

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware component: Content Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

PT-2026-118626

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The app-data copy seeder uses the shutil.copy function to copy cached package files into new environments. This process causes cached source modes to override the current run's umask a user...

PT-2026-119249

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-common-concurrency-limits. Supported versions that are affected are 4.0.0-4.5.5 and 27.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon...

PT-2026-118239

UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-service DoS condition...

PT-2026-118328

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary activityID via GET or POST to modify or delete activity and...

PT-2026-118100

Name of the Vulnerable Software and Affected Versions Zyxel EX3501-T0 versions through 5.44ACHR.6C0 Description An incorrect authorization issue exists in the Data Access Layer DAL of the device. This flaw allows an authenticated attacker to escalate privileges by modifying the login privilege...

PT-2026-120048

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft component: Common Objects. The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

PT-2026-118241

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.20 Roundcube Webmail versions 1.7.x prior to 1.7.5 Description Remote authenticated attackers can perform IMAP command injection by injecting CRLF sequences into the uid parameter of the 'mail/headers' a...

PT-2026-119525

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite component: Product Diagnostic Tools. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order...

PT-2026-118252

The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update license AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...

PT-2026-119984

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Image Export SDK. The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In...

PT-2026-120146

The FTP client trusts the server's PASV response IP:port without validation against the control connection target. A rogue FTP server can specify any IP:port in the 227 Passive Mode response, causing the operator's machine to open a TCP connection to an arbitrary host...

PT-2026-119515

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successf...

PT-2026-118748

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption in CSS allows a remote attacker to potentially read memory inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome to version 156.0.8078....

PT-2026-119298

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: InnoDB. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily exploitable vulnerability...

PT-2026-118937

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description A use after free issue exists in the Chromecast component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote...

PT-2026-119041

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description A use after free issue in Performance allows a remote attacker to execute arbitrary code inside the sandbox by using a crafted HTML page. Use after free is a memory corruption flaw that...

PT-2026-119167

Vulnerability in Oracle Secure Backup component: Backup and Restore. Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup. While the vulnerability is in...

PT-2026-118290

A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices...

PT-2026-118424

Name of the Vulnerable Software and Affected Versions Booktics versions prior to 1.0.31 Description An issue exists where missing authorization allows for the exploitation of incorrectly configured access control security levels. Recommendations Update to version 1.0.31 or later...

PT-2026-120018

Vulnerability in the Workflow product of Oracle E-Business Suite component: Workflow Notification Mailer. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Workflow. Successful...

PT-2026-118509

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description An issue in the exist-in-locale API allows an authenticated low-privilege user to determine if restricted documents exist in a specific locale and mode, including draft mode. The endpoint...

PT-2026-119954

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Server Infrastructure. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to...

PT-2026-120310

Summary When uploadfs is configured with the Azure backend and sas: true a supported configuration introduced in uploadfs 1.25.0, createContainer builds the BlobServiceClient from a URL that embeds the full SAS query string, and Azure SDK v12 derived clients inherit that query string. As a result...

PT-2026-118719

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption in PDFium allows a remote attacker to potentially execute arbitrary code inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome to versi...

PT-2026-120037

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: BI Foundation. The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Busine...

PT-2026-118824

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption in the Browser component allows a remote attacker to potentially execute arbitrary code inside the sandbox by inducing the user to visit a crafted HTML page...

PT-2026-118755

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description A use after free issue exists in the WebUI, which allows a remote attacker to execute arbitrary code within the sandbox by using a specially crafted HTML page. Use after free is a memor...

PT-2026-118961

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Improper input validation in Extensions allows a remote attacker to potentially execute arbitrary code inside the sandbox by using a crafted HTML page. Recommendations Update Google...

PT-2026-118635

Name of the Vulnerable Software and Affected Versions Kiro Crew versions prior to 0.7.2 Description Missing authorization in the WhatsApp group channel allows a remote actor who is a member of an operator-configured WhatsApp group to control other agent sessions of the operator. This occurs becau...

PT-2026-119257

Vulnerability in the Helidon product of Oracle Fusion Middleware component: helidon-cors. Supported versions that are affected are 4.0.0-4.5.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks require human...

PT-2026-119617

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware component: Content Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

PT-2026-118449

Name of the Vulnerable Software and Affected Versions ApostropheCMS import-export module versions prior to 3.7.1 Description Predictable export archive filenames allow an unauthenticated requester to download another user's export from publicly readable export storage before the archive expires o...

PT-2026-119152

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Server Infrastructure. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to...

PT-2026-119006

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description An out of bounds read exists in the Media component, which allows a remote attacker to read memory inside the sandbox by using a specially crafted HTML page. An out of bounds read occur...

PT-2026-120119

Vulnerability in Oracle Essbase component: Security. The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may...

PT-2026-118473

Unpatched vulnerabilities don't stay hidden on our atlas. CVE CRITICAL VULNERABILITY DETECTED CVE ID: CVE-2026-113613 Vendor: Unknown Severity: Critical — CVSS 9.2 Product: Unknown Date: 2026-10-20 A critical vulnerability Path Traversal has been disclosed affecting Unknown. Patch immediately...

PT-2026-118490

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.34.0 Description A project-defined free-form widget style field allows an editor-controlled quote to be inserted into an inline style attribute because the wrapper serializer fails to apply HTML-attribute...

PT-2026-119134

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM component: Siebel Cloud Manager. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud...

PT-2026-118957

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption in Core allows a remote attacker to potentially execute arbitrary code inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome to version...

PT-2026-117986

An input validation issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Processing a maliciously crafted image may lead to unexpected process termination...

PT-2026-119481

Name of the Vulnerable Software and Affected Versions Oracle Product Workbench versions 12.2.3 through 12.2.15 Description An issue in the WebUI component of the Oracle Product Workbench allows an unauthenticated attacker with network access via HTTP to compromise the system. This can lead to...

PT-2026-120147

Metasploit Framework versions before 6.5.7 allow HTTP requests made through send request cgi! to follow redirects to a different host without restricting the redirect destination. A malicious HTTP server can cause the system running Metasploit to make requests to arbitrary HTTP services reachable...

PT-2026-119451

Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL component: Server: Components Services. Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and 26.7.0-26.7.1. Easily...

PT-2026-119017

Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-117992

An authorization issue was addressed with improved network restrictions. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to initiate calls or send messages...

PT-2026-119795

Vulnerability in the PeopleSoft Enterprise SCM Manufacturing product of Oracle PeopleSoft component: Security. The supported version that is affected is 9.2. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise SCM...

PT-2026-118447

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.34.0 Description The color field allows trailing content after a valid rgb or hsl prefix because the TinyColor validation does not require the entire value to match a color. An authenticated user with edit...

PT-2026-119779

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Runtime Tools. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...