PT-2026-119430

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: DB Privileges. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Application...

PT-2026-119280

Vulnerability in Oracle TimesTen In-Memory Database component: TimesTen IMDB. Supported versions that are affected are 26.1-26.1.1.3.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle TimesTen In-Memory Database executes to compromis...

PT-2026-119745

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware component: BPM Composer. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

PT-2026-118444

Raptor RDF Syntax Library from 2.0.15 through 2.0.16 contains a heap-based buffer overflow vulnerability in raptor new term from counted literal caused by truncating language tag length to an unsigned char. Attackers can supply Turtle, TriG, N-Triples or N-Quads documents with language tags of 25...

PT-2026-119183

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Siebel Approval Manager. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Development...

PT-2026-118650

A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger...

PT-2026-120030

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain component: Product Quality Management. The supported version that is affected is 6.2.4. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to...

PT-2026-118458

Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete alarms of other domains via the POST /api/v2/alarms/bulk delete/ action. Attackers can enumerate sequential alarm IDs to delete DNS, MX and blocklist monitoring alarms...

PT-2026-119961

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Server Infrastructure. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to...

PT-2026-118470

Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged authenticated users to modify other users' preferences by supplying an arbitrary target user id. Attackers can delete the preferences.otp TOTP secret to disabl...

PT-2026-119587

Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite component: Diagnostics. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications...

PT-2026-119117

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: SQR. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools...

PT-2026-118242

Hidden functionality issue exists in Multiple DVRs Digital Video Recorders provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware...

PT-2026-119738

Name of the Vulnerable Software and Affected Versions Oracle Solaris version 11.4 Description An issue exists in the X Window System component. A low privileged attacker with logon access to the infrastructure where the system executes can compromise the environment. Successful exploitation may...

PT-2026-120098

Vulnerability in Oracle Essbase component: Security. The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in...

PT-2026-118425

Cross-Site Request Forgery CSRF vulnerability in e4jvikwp VikRentCar vikrentcar allows Cross Site Request Forgery.This issue affects VikRentCar: from n/a through 1.4.8...

PT-2026-118380

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.26 Apache Tomcat versions 10.1.0-M1 through 10.1.60 Apache Tomcat versions 9.0.0.M1 through 9.0.122 Apache Tomcat versions 8.5.0 through 8.5.100 Apache Tomcat versions 7.0.0 through 7.0.109...

PT-2026-118442

One logical thread of a user-mode ThreadX module costs the Module Manager's shared object pool two allocations, not one. The module asks for a TX THREAD control block through txm module object allocate; txm module manager thread create then takes a second allocation of TXM MODULE KERNEL STACK SIZ...

PT-2026-119624

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Enterprise Infrastructure SEC. Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SMTP to compromise JD...

PT-2026-118793

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 156.0.8078.47 Description Memory corruption occurs in the Text component, which allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted...

PT-2026-118279

A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism...

PT-2026-119202

Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications component: System Wide. Supported versions that are affected are 2.4.0.1.0-2.4.0.1.33, 2.5.0.1.0-2.5.0.1.18, 2.5.0.2.0-2.5.0.2.11, 2.6.0.1.0-2.6.0.1.12, 2.6.0.2.0-2.6.0.2.9 and...

PT-2026-119953

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Server Infrastructure. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to...

PT-2026-119136

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Siebel Management Console. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment...

PT-2026-118419

Name of the Vulnerable Software and Affected Versions A2A Java SDK versions prior to 1.3.0.Final Description The default InMemoryTaskStore configuration does not perform authorization on task reads. The no-argument constructor sets the authorizationProvider to null, and the getString taskId...

PT-2026-119720

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Applications DBA versions 12.2.3 through 12.2.15 Description A flaw in the AD Utilities component allows a low-privileged attacker with access to the infrastructure where Applications DBA executes to compromise the...

PT-2026-118388

Name of the Vulnerable Software and Affected Versions A2A Java SDK versions prior to 1.3.0.Final Description An unauthenticated caller can coerce the server into issuing HTTP requests to arbitrary internal and cloud-metadata endpoints from the server's own network position. This occurs because th...

PT-2026-118401

Name of the Vulnerable Software and Affected Versions filelock versions 3.20.4 through 4.2.0 Description The ReadWriteLock allows SQLite to reopen the database and side files by name. On POSIX systems, an attacker with rename access in a non-sticky parent directory can swap these names to trigger...

PT-2026-120318

--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...

PT-2026-118402

Name of the Vulnerable Software and Affected Versions filelock versions 4.1.0 through 4.2.0 Description SoftReadWriteLock and AsyncSoftReadWriteLock cache a successful check of the .rw lock tree and resolve its names again during later record operations. This behavior allows a local user to repla...

PT-2026-119206

Name of the Vulnerable Software and Affected Versions Oracle APEX versions 24.1.0 through 24.1.21 Oracle APEX versions 24.2.0 through 24.2.20 Oracle APEX versions 26.1.0 through 26.1.4 Description An unauthenticated attacker with network access via HTTPS can compromise Oracle APEX. Successful...

PT-2026-119325

Vulnerability in the Oracle iSetup product of Oracle E-Business Suite component: General Ledger Update Transform, Reports. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

PT-2026-119235

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite component: Element Types, Links, Entries. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll...

PT-2026-119862

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft component: Common Application Objects. The supported version that is affected is 9.2. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise...

PT-2026-118642

A OS command injection vulnerability exists in the boa formUpload functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

PT-2026-118667

An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

PT-2026-120343

Name of the Vulnerable Software and Affected Versions @modelcontextprotocol/sdk versions 1.6.0 through 1.31.0 @modelcontextprotocol/server versions 2.0.0 through 2.2.0 @modelcontextprotocol/express versions 2.0.0 through 2.0.1 @modelcontextprotocol/server-legacy versions 2.0.0 through 2.3.0...

PT-2026-118245

The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its contact-management read AJAX actions, allowing any authenticated user with a role as low as subscriber to read other users' CRM contact and lead records, including their private...

PT-2026-118761

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption occurs in the OptimizationGuide component, which could allow a remote attacker to potentially execute arbitrary code within the sandbox by inducing the user to visit a...

PT-2026-118988

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption occurs in the FullScreen component, which could allow a remote attacker to execute arbitrary code within the sandbox by inducing the user to visit a specially crafted...

PT-2026-118725

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description A use after free issue exists in the Media component. This flaw allows a remote attacker to execute arbitrary code within the sandbox by inducing the user to open a specially crafted HT...

PT-2026-119593

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware component: Data Transforms. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Data...

PT-2026-119147

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Server Infrastructure. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Deployment. Successfu...

PT-2026-119666

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Updates Environment Mgmt. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterpris...

PT-2026-119735

Name of the Vulnerable Software and Affected Versions Oracle Service Bus version 14.1.2.0.0 Description A flaw in the Core component of the Oracle Service Bus product of Oracle Fusion Middleware allows a low privileged attacker with network access via HTTP to compromise the system. Successful...

PT-2026-119236

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Payroll. Successful...

PT-2026-118437

A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for using an object, and using an object a module does not own is...

PT-2026-118947

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description A use after free issue exists in ANGLE, a compatibility layer that allows OpenGL ES APIs to run on non-native platforms. This flaw allows a remote attacker to potentially execute...

PT-2026-117953

Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to access other spaces' workflows by supplying foreign workflowIDs. Attackers can pair their own spaceID with another tenant's workflowID in save, update meta, batch...

PT-2026-119540

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Business Interlink. Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise...