PT-2026-119499

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite component: MWA Terminal Server. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Mobil...

PT-2026-120103

Vulnerability in Oracle Essbase component: Security. The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Essbase. While the vulnerability is in Oracle Essbase, attacks may...

PT-2026-118500

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description An authenticated editor with legitimate edit rights on a page nested under a restricted parent can manipulate the sibling ordering of other pages under that same parent. This occurs because th...

PT-2026-119196

Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are 19.3-19.32, 21.3-21.23 and 23.4.0-23.26.3. Easily exploitable vulnerability allows high privileged attacker having None privilege with logon to the infrastructure where Oracle Ne...

PT-2026-119241

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite component: PO View Document. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing. Successful...

PT-2026-119708

Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where WebCenter Content: Imagi...

PT-2026-119971

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM component: Server Infrastructure. Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Siebel CRM Deployment executes to...

PT-2026-119829

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Web Runtime SEC. Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseO...

PT-2026-118707

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description An out of bounds read exists in the Extensions component, which allows a remote attacker to read memory inside the sandbox by using a crafted HTML page. An out of bounds read occurs whe...

PT-2026-119726

Name of the Vulnerable Software and Affected Versions Oracle Solaris version 11.4 Description A flaw in the Filesystems component allows a low-privileged attacker with local access to the infrastructure to compromise the system. Successful exploitation can lead to a system hang or frequent crashe...

PT-2026-118617

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The PipInvoke.get pip install cmd function handles the --seeder pip --download configuration by calling get wheeldownload=False, which allows pip to consult the configured index. This process...

PT-2026-118670

A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

PT-2026-119997

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware component: Outside In Clean Content SDK. The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Outside In...

PT-2026-119530

Name of the Vulnerable Software and Affected Versions djust versions 0.9.0 through 1.0.9 djust versions 1.1.0 through 1.1.6 djust versions 1.2.0 through 1.2.3 djust versions 1.3.0rc1 through 1.3.0rc7 Description The find handlers for template MCP tool in python/djust/mcp/server.py accepts an...

PT-2026-118496

Name of the Vulnerable Software and Affected Versions uploadfs versions prior to 1.28.0 Description The local storage backend of the uploadfs library fails to properly validate or sanitize user-supplied paths. The prefixPath function only removes double slashes and does not normalize paths or...

PT-2026-119363

Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite component: SOA Provider. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise...

PT-2026-119514

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Purchasing...

PT-2026-119110

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Report Distribution. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

PT-2026-119012

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description Memory corruption in ANGLE allows a remote attacker to potentially execute arbitrary code inside the sandbox by using a crafted HTML page. Recommendations Update Google Chrome to versio...

PT-2026-119744

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware component: Generic REST. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracl...

PT-2026-119996

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft component: eProcurement. The supported version that is affected is 9.1. Easily exploitable vulnerability allows high privileged attacker with access to the physical communication segment attached to...

PT-2026-118304

The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itself. Anyone who can request a CAPTCHA image can read the answer from it and submit it, so automated clients can pass the challenge. This applies to the default configuration, because the audio feature...

PT-2026-118467

Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read restricted reports through the block configurable reports get report data web service. When check permissions fails, the function only adds a warning and still...

PT-2026-119990

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft component: Integration. The supported version that is affected is 9.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to compromise PeopleSoft...

PT-2026-120152

Name of the Vulnerable Software and Affected Versions Duplicator versions prior to 5.0.0 Duplicator Pro versions prior to 5.0.0 Description An unauthenticated PHP Object Injection exists due to the deserialization of untrusted database content within the unserializeTest function of the DUPX...

PT-2026-118384

Name of the Vulnerable Software and Affected Versions filelock versions 4.1.0 through 4.2.0 Description In the SoftFileLock implementation, a stale observation can be reused. This occurs when an attacker pre-dates and removes their own marker while at least two lock-user processes are waiting. If...

PT-2026-118394

Name of the Vulnerable Software and Affected Versions filelock versions 4.1.0 through 4.2.0 Description In the SoftFileLock component, the software can restore a stale marker by name after moving it aside. This allows a local user with rename access in a non-sticky lock directory to replace the...

PT-2026-118399

Name of the Vulnerable Software and Affected Versions filelock versions 4.1.0 through 4.2.0 Description The ReadWriteLock function can remove a randomized .filelock- private-hard-link directory during cleanup. This allows a local user with rename access in a non-sticky parent directory to observe...

PT-2026-118615

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description The download wheel function writes package-index downloads directly into the reusable wheel/house cache before selecting a verification target from the textual Saved output of pip. When...

PT-2026-118625

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.14.9 Description An issue exists where PipInstall. uninstall previous version accepts existing seed-package metadata and uninstall dist joins entries from top level.txt and RECORD to site-packages without...

PT-2026-118636

An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this...

PT-2026-118638

A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

PT-2026-118639

A OS command injection vulnerability exists in the batchupg functionality of X2000R versions: TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

PT-2026-118672

Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...

PT-2026-119047

Vulnerability in Oracle REST Data Services component: Core. Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can...

PT-2026-119048

Vulnerability in Oracle REST Data Services component: Core. Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can...

PT-2026-119175

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Portal. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools...

PT-2026-119526

DBI versions before 1.656 for Perl crash via type confusion in dbi profile when a database handle is destroyed under a Profile Path with an attr element. An attr element names a database handle attribute, which dbi profile reads from the handle's inner hash. It expects the inner handle as a...

PT-2026-118816

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 156.0.8078.47 Description A use after free issue exists in the Network component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote...

PT-2026-119652

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Enterprise Infrastructure SEC. Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards...

PT-2026-118376

A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly...

PT-2026-118377

A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results in path traversal. It is possible to launch the...

PT-2026-119826

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Enterprise Infrastructure SEC. Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwar...

PT-2026-118433

A missing bounds check in the TLS 1.3 Certificate-message parser of NetX Secure lets a malicious TLS 1.3 server trigger an unsigned-integer underflow and a subsequent heap out-of-bounds read in any peer that processes a remote Certificate message. It is reachable pre-authentication, during the...

PT-2026-119999

Vulnerability in the Oracle JavaFX product of Oracle Java SE component: JavaFX. Supported versions that are affected are Oracle JavaFX: 25.0.4 and 27. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle JavaFX...

PT-2026-118498

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.33.0 Description In this Node.js content management system, the viewRole is not applied to anonymous visitors when a developer exposes user objects through a publicly rendered relationship or an expressly...

PT-2026-120016

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware component: LDAP Gateway. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TCP to compromise Orac...

PT-2026-119754

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware component: Human Workflow 11g+. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to...

PT-2026-118344

A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead to open redirect. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not...

PT-2026-119547

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component: Meta Data. Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...