PT-2026-119757

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware component: Adapters. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Successf...

PT-2026-119734

Name of the Vulnerable Software and Affected Versions Oracle Service Bus versions 12.2.1.4.0 Oracle Service Bus versions 14.1.2.0.0 Description A flaw in the Core component of Oracle Service Bus allows a low privileged attacker with network access via HTTP to compromise the system. Successful...

PT-2026-119740

Vulnerability in the Oracle Solaris product of Oracle Systems component: Services. The supported version that is affected is 11.4. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris...

PT-2026-119844

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Installation Security. Supported versions that are affected are 9.2.0.0-9.2.26.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards...

PT-2026-118668

A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

PT-2026-119793

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware component: Content Server. The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content...

PT-2026-117940

An authorization issue was addressed with improved state management. This issue is fixed in visionOS 27. An app may be able to access sensitive user data...

PT-2026-118343

A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early abou...

PT-2026-120084

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Difficult to exploit vulnerability allows low privileged attacker having None privilege with network access via SOCKS5 to compromise Java VM. While...

PT-2026-119280

Vulnerability in Oracle TimesTen In-Memory Database component: TimesTen IMDB. Supported versions that are affected are 26.1-26.1.1.3.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle TimesTen In-Memory Database executes to compromis...

PT-2026-119183

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Siebel Approval Manager. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development...

PT-2026-118458

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms...

PT-2026-118470

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...

PT-2026-119587

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite component: Diagnostics. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications...

PT-2026-118242

Hidden functionality issue exists in Multiple DVRs Digital Video Recorders provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware...

PT-2026-119738

Name of the Vulnerable Software and Affected Versions Oracle Solaris version 11.4 Description An issue exists in the X Window System component. A low privileged attacker with logon access to the infrastructure where the system executes can compromise the environment. Successful exploitation may...

PT-2026-118380

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.26 Apache Tomcat versions 10.1.0-M1 through 10.1.60 Apache Tomcat versions 9.0.0.M1 through 9.0.122 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.0 through 7.0.109...

PT-2026-119624

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Enterprise Infrastructure SEC. Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise JD...

PT-2026-118279

A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism...

PT-2026-119136

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Siebel Management Console. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment...

PT-2026-119720

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Applications DBA versions 12.2.3 through 12.2.15 Description A flaw in the AD Utilities component allows a low-privileged attacker with access to the infrastructure where Applications DBA executes to compromise the...

PT-2026-118388

Name of the Vulnerable Software and Affected Versions A2A Java SDK versions prior to 1.3.0.Final Description An unauthenticated caller can coerce the server into issuing HTTP requests to arbitrary internal and cloud-metadata endpoints from the server's own network position. This occurs because th...

PT-2026-118401

Name of the Vulnerable Software and Affected Versions filelock versions 3.20.4 through 4.2.0 Description The ReadWriteLock allows SQLite to reopen the database and side files by name. On POSIX systems, an attacker with rename access in a non-sticky parent directory can swap these names to trigger...

PT-2026-120318

--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...

PT-2026-118402

Name of the Vulnerable Software and Affected Versions filelock versions 4.1.0 through 4.2.0 Description SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the .rw lock tree and resolve its names again during later record operations. This behavior allows a local user to repla...

PT-2026-119235

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite component: Element Types, Links, Entries. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll...

PT-2026-119862

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft component: Common Application Objects. The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise...

PT-2026-118667

An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

PT-2026-120343

Name of the Vulnerable Software and Affected Versions @modelcontextprotocol/sdk versions 1.6.0 through 1.31.0 @modelcontextprotocol/server versions 2.0.0 through 2.2.0 @modelcontextprotocol/express versions 2.0.0 through 2.0.1 @modelcontextprotocol/server-legacy versions 2.0.0 through 2.3.0...

PT-2026-118245

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private...

PT-2026-119593

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware component: Data Transforms. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data...

PT-2026-119147

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Server Infrastructure. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successfu...

PT-2026-119666

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Updates Environment Mgmt. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterpris...

PT-2026-119735

Name of the Vulnerable Software and Affected Versions Oracle Service Bus version 14.1.2.0.0 Description A flaw in the Core component of the Oracle Service Bus product of Oracle Fusion Middleware allows a low privileged attacker with network access via HTTP to compromise the system. Successful...

PT-2026-119236

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful...

PT-2026-118437

A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for using an object, and using an object a module does not own is...

PT-2026-117953

Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update meta, batch...

PT-2026-119540

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Business Interlink. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise...

PT-2026-119550

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Data Mover. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTool...

PT-2026-119542

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Query. Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

PT-2026-119762

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware component: Fabric Layer. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. Whil...

PT-2026-119688

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware component: Content Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment...

PT-2026-119771

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware component: Fabric Layer. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise Oracle SO...

PT-2026-119801

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Monitoring and Diagnostics SEC. Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD...

PT-2026-119308

Vulnerability in the MySQL Cluster product of Oracle MySQL component: Cluster: NDB Operator. The supported version that is affected is 9.7.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise MySQL Cluster. Successful attacks of this...

PT-2026-119631

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Enterprise Infrastructure SEC. Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with network access via JDENET to compromise JD...

PT-2026-118416

A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page...

PT-2026-118462

json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks by inserting a literal 0x1A character. Attackers can append 0x1A and malformed content to pass JSONValue.parseStrict or isValidJsonStrict validation, creating...

PT-2026-119271

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain component: Product Quality Management. The supported version that is affected is 6.2.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

PT-2026-119713

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Core. The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Outside In...