| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-83370 | Hig | 0.49 | 7.5 | 0.00 | Oct 20, 2026 | Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Sourcing. Successful… | ||
| CVE-2026-83367 | Hig | 0.48 | 7.4 | 0.00 | Oct 20, 2026 | Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to… | ||
| CVE-2026-83366 | Hig | 0.48 | 7.4 | 0.00 | Oct 20, 2026 | Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise… | ||
| CVE-2026-83363 | Hig | 0.57 | 8.8 | 0.00 | Oct 20, 2026 | Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via… | ||
| CVE-2026-83361 | Hig | 0.53 | 8.1 | 0.00 | Oct 20, 2026 | Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via… | ||
| CVE-2026-83360 | Med | 0.42 | 6.5 | 0.00 | Oct 20, 2026 | Vulnerability in the Oracle HRMS (Republic of Korea) product of Oracle E-Business Suite (component: Korean Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to… | ||
| CVE-2026-83359 | Med | 0.42 | 6.5 | 0.00 | Oct 20, 2026 | Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Indian Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle… | ||
| CVE-2026-83358 | Med | 0.42 | 6.5 | 0.00 | Oct 20, 2026 | Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise… | ||
| CVE-2026-83139 | Med | 0.42 | 6.5 | 0.00 | Oct 20, 2026 | Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to… | ||
| CVE-2026-82891 | Hig | 0.53 | 8.1 | 0.01 | Oct 20, 2026 | IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key. | ||
| CVE-2026-81212 | Cri | 0.65 | 10.0 | 0.00 | Oct 20, 2026 | IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters. | ||
| CVE-2026-76587 | Hig | 0.57 | 8.8 | 0.01 | Oct 20, 2026 | IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system. | ||
| CVE-2026-73964 | Low | 0.18 | 2.7 | 0.00 | Oct 20, 2026 | Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32 and 21.3-21.23. Easily exploitable vulnerability allows high privileged attacker having Query Optimizer privilege with network access via Oracle Net to… | ||
| CVE-2026-70869 | Med | 0.31 | 4.7 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise… | ||
| CVE-2026-70860 | Med | 0.38 | 5.9 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to… | ||
| CVE-2026-60968 | Med | 0.39 | 6.0 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where… | ||
| CVE-2026-60964 | Low | 0.12 | 1.9 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Open Query). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where… | ||
| CVE-2026-60887 | Low | 0.25 | 3.8 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Data Mover). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft… | ||
| CVE-2026-60885 | Med | 0.44 | 6.8 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with access to the physical… | ||
| CVE-2026-60882 | Med | 0.34 | 5.3 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical… | ||
| CVE-2026-60881 | Med | 0.42 | 6.5 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Meta Data). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft… | ||
| CVE-2026-60878 | Med | 0.29 | 4.4 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Process Scheduler). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to… | ||
| CVE-2026-60876 | Med | 0.27 | 4.2 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework). The supported version that is affected is 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise… | ||
| CVE-2026-60874 | Med | 0.27 | 4.2 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise… | ||
| CVE-2026-60869 | Med | 0.44 | 6.8 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Application Data Sets). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to… | ||
| CVE-2026-60839 | Med | 0.36 | 5.5 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise… | ||
| CVE-2026-60819 | Low | 0.24 | 3.7 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Application Server - JRE). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSH to… | ||
| CVE-2026-60814 | Low | 0.25 | 3.9 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where… | ||
| CVE-2026-60809 | Med | 0.27 | 4.2 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Weblogic). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment… | ||
| CVE-2026-60746 | Med | 0.38 | 5.9 | 0.00 | Oct 20, 2026 | Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to… | ||
| CVE-2026-60745 | Med | 0.29 | 4.4 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Application Server - JRE). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where… | ||
| CVE-2026-60743 | Med | 0.42 | 6.5 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Weblogic). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise PeopleSoft… | ||
| CVE-2026-60662 | Hig | 0.51 | 7.8 | 0.00 | Oct 20, 2026 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise… | ||
| CVE-2026-60500 | Med | 0.38 | 5.8 | 0.00 | Oct 20, 2026 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Web Server). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise… | ||
| CVE-2026-60453 | Med | 0.34 | 5.3 | 0.00 | Oct 20, 2026 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: X Window System). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to… | ||
| CVE-2026-60432 | Cri | 0.64 | 9.8 | 0.00 | Oct 20, 2026 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). Supported versions that are affected are 11.3 and 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle… | ||
| CVE-2026-47025 | Hig | 0.57 | 8.8 | 0.00 | Oct 20, 2026 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affected are 11.3 and 11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris. Successful… | ||
| CVE-2026-113812 | Cri | 0.52 | 9.1 | 0.00 | Oct 20, 2026 | Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly… | ||
| CVE-2026-113776 | Hig | 0.44 | 7.8 | 0.00 | Oct 20, 2026 | virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate_template() replaces placeholders one key at a time across the complete activation template, so trigger names such as __VIRTUAL_NAME__,… | ||
| CVE-2026-113732 | Hig | 0.44 | 7.8 | 0.00 | Oct 20, 2026 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(), which uses POSIX shlex.quote() even though fish interprets backslashes and single quotes differently. An attacker-influenced environment… | ||
| CVE-2026-113731 | Low | 0.14 | 3.3 | 0.00 | Oct 20, 2026 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the find_handlers_for_template MCP tool in python/djust/mcp/server.py accepts an existing absolute template_path… | ||
| CVE-2026-113730 | Med | 0.29 | 5.6 | 0.00 | Oct 20, 2026 | OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or… | ||
| CVE-2026-113729 | Hig | 0.42 | 7.5 | 0.00 | Oct 20, 2026 | Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks.… | ||
| CVE-2026-113728 | Hig | 0.42 | 7.5 | 0.01 | Oct 20, 2026 | Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket… | ||
| CVE-2026-113727 | Hig | 0.41 | 7.4 | 0.00 | Oct 20, 2026 | OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored… | ||
| CVE-2026-113726 | Hig | 0.44 | 7.8 | 0.00 | Oct 20, 2026 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASH_VERSION… | ||
| CVE-2026-113704 | — | Hig | 0.40 | 7.3 | 0.01 | Oct 20, 2026 | A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to… | |
| CVE-2026-113344 | Hig | 0.57 | 8.8 | 0.00 | Oct 20, 2026 | Improper state validation in Performance in Google Chrome prior to 156.0.8078.47 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium) | ||
| CVE-2026-113343 | Hig | 0.57 | 8.8 | 0.00 | Oct 20, 2026 | Incorrect authorization in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||
| CVE-2026-113342 | Cri | 0.62 | 9.6 | 0.00 | Oct 20, 2026 | Privilege elevation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) |
- risk 0.49cvss 7.5epss 0.00
Vulnerability in the Sourcing product of Oracle E-Business Suite (component: Auctions). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Sourcing. Successful…
- risk 0.48cvss 7.4epss 0.00
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via Oracle Net to…
- risk 0.48cvss 7.4epss 0.00
Vulnerability in the Oracle Shipping Execution product of Oracle E-Business Suite (component: Workflow Events). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise…
- risk 0.57cvss 8.8epss 0.00
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via…
- risk 0.53cvss 8.1epss 0.00
Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via…
- risk 0.42cvss 6.5epss 0.00
Vulnerability in the Oracle HRMS (Republic of Korea) product of Oracle E-Business Suite (component: Korean Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to…
- risk 0.42cvss 6.5epss 0.00
Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Indian Payroll). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle…
- risk 0.42cvss 6.5epss 0.00
Vulnerability in the Oracle HRMS (Norway) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise…
- risk 0.42cvss 6.5epss 0.00
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to…
- risk 0.53cvss 8.1epss 0.01
IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.
- risk 0.65cvss 10.0epss 0.00
IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant's key. This collapses the platform's credential-encryption boundary and lets an anonymous caller poison any tenant's cached flow parameters.
- risk 0.57cvss 8.8epss 0.01
IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.
- risk 0.18cvss 2.7epss 0.00
Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.32 and 21.3-21.23. Easily exploitable vulnerability allows high privileged attacker having Query Optimizer privilege with network access via Oracle Net to…
- risk 0.31cvss 4.7epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise…
- risk 0.38cvss 5.9epss 0.00
Vulnerability in the PeopleSoft Enterprise FIN Common Objects Argentina product of Oracle PeopleSoft (component: eProcurement). The supported version that is affected is 9.1. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to…
- risk 0.39cvss 6.0epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where…
- risk 0.12cvss 1.9epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Open Query). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where…
- risk 0.25cvss 3.8epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Data Mover). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft…
- risk 0.44cvss 6.8epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Push Notifications). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with access to the physical…
- risk 0.34cvss 5.3epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical…
- risk 0.42cvss 6.5epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Meta Data). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise PeopleSoft…
- risk 0.29cvss 4.4epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Process Scheduler). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to…
- risk 0.27cvss 4.2epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Search Framework). The supported version that is affected is 8.62. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise…
- risk 0.27cvss 4.2epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise…
- risk 0.44cvss 6.8epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Application Data Sets). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to…
- risk 0.36cvss 5.5epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Supported versions that are affected are 8.61 and 8.62. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise…
- risk 0.24cvss 3.7epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Application Server - JRE). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via SSH to…
- risk 0.25cvss 3.9epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where…
- risk 0.27cvss 4.2epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Weblogic). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment…
- risk 0.38cvss 5.9epss 0.00
Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to…
- risk 0.29cvss 4.4epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Application Server - JRE). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where…
- risk 0.42cvss 6.5epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Weblogic). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with network access via TLS to compromise PeopleSoft…
- risk 0.51cvss 7.8epss 0.00
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Services). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise…
- risk 0.38cvss 5.8epss 0.00
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Web Server). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise…
- risk 0.34cvss 5.3epss 0.00
Vulnerability in the Oracle Solaris product of Oracle Systems (component: X Window System). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to…
- risk 0.64cvss 9.8epss 0.00
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Image Packaging System). Supported versions that are affected are 11.3 and 11.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle…
- risk 0.57cvss 8.8epss 0.00
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affected are 11.3 and 11.4. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Solaris. Successful…
- risk 0.52cvss 9.1epss 0.00
Mozilla::CA versions before 20261020 for Perl provide a CA certificate bundle containing a root linked to compromised intermediates. The bundle includes "emSign ECC Root CA - G3", which provides a trust path for intermediate certificates whose private keys are publicly…
- risk 0.44cvss 7.8epss 0.00
virtualenv is a tool for creating isolated virtual python environments. From 20.26.6 until 21.14.2, ViaTemplateActivator.instantiate_template() replaces placeholders one key at a time across the complete activation template, so trigger names such as __VIRTUAL_NAME__,…
- risk 0.44cvss 7.8epss 0.00
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.2, FishActivator inherits ViaTemplateActivator.quote(), which uses POSIX shlex.quote() even though fish interprets backslashes and single quotes differently. An attacker-influenced environment…
- risk 0.14cvss 3.3epss 0.00
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the find_handlers_for_template MCP tool in python/djust/mcp/server.py accepts an existing absolute template_path…
- risk 0.29cvss 5.6epss 0.00
OGNL is an Object Graph Navigation Library for Java. Prior to 3.4.13, the optional stricter-invocation mode in OgnlRuntime.invokeMethod checks the declaring class of the method that OGNL invokes but does not block java.lang.reflect.Method, java.lang.reflect.Constructor, or…
- risk 0.42cvss 7.5epss 0.00
Moov signedxml is a pure Go library for processing signed XML documents. Prior to 1.4.1, ExclusiveCanonicalization in exclusivecanonicalization.go copies the complete accumulated namespace map at every nested element before reference digest or signature checks.…
- risk 0.42cvss 7.5epss 0.01
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.9.2, the unauthenticated POST /api/fetch-ical endpoint validates a caller-supplied hostname with one DNS lookup and then passes the URL to fetch, which performs a separate lookup for the socket…
- risk 0.41cvss 7.4epss 0.00
OpenChoreo is a developer platform for Kubernetes. From 1.0.0 until 1.0.6, 1.1.7, and 1.2.5, the PUT .../workflowruns/{runName} update route authorizes a request using the openchoreo.dev/project and openchoreo.dev/component labels in the submitted body while selecting the stored…
- risk 0.44cvss 7.8epss 0.00
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.13.0, the bash activate script that zsh also sources leaves the environment name unescaped; from 21.13.0 until 21.14.4, it escapes backslashes, dollar signs, and backticks only when BASH_VERSION…
- risk 0.40cvss 7.3epss 0.01
A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to…
- risk 0.57cvss 8.8epss 0.00
Improper state validation in Performance in Google Chrome prior to 156.0.8078.47 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium)
- risk 0.57cvss 8.8epss 0.00
Incorrect authorization in Sandbox in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
- risk 0.62cvss 9.6epss 0.00
Privilege elevation in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)