Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,917 results · page 1 of 59
Oct 28, 2026The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store.CVE-2026-116641 · Other software · MongoDB · reported by cna@mongodb.comHigh 7.6
The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list. DB Tools version 100.19.0 was compiled with Golang 1.26.8, which does not include this check. The issue is resolved by updating to Golang 1.27.3 in DB Tools 100.20.0
- Product
- Database Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas.CVE-2026-118666 · Other software · ardatan · reported by GitHubMedium 6
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts reuses one WebSocket and replaces its single websocket.onmessage handler whenever a new overlapping subscription starts. The handler delivers LEGACY_WS.DATA frames to the newest observer without comparing data.id with the subscription operation id, so a caller using the same executor can receive another user's authorized subscription payload while the earlier caller's stream is starved. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.
- Product
- graphql-tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas.CVE-2026-118665 · Other software · ardatan · reported by GitHubHigh 8.2
GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request.extensions.connectionParams in the closure-scoped executorConnectionParams object after cleanupWebsocket closes a connection. When one executor is reused across different authorization contexts, a later request that omits a sensitive key can send an earlier caller's Authorization or tenant value in its connection_init payload, causing the downstream server to authenticate the later caller as the earlier user. Applications that create a new executor for every request are not affected. This issue is fixed in version 1.1.36 of the GraphQL Tools legacy WebSocket executor package.
- Product
- graphql-tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the ageCVE-2026-115415 · Other software · amazon · reported by ff89ba41-3aa1-4d27-914a-91399e9639e5Medium 5.9
Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6 might allow remote actors to obtain the agent host's environment variables in cleartext, including cloud credentials and API keys, via a crafted prompt that disables the tool's secret masking. To remediate this issue, users should upgrade to version 0.8.6 or later and rotate any credentials that were present in the environment of agents that loaded the environment tool.
- Product
- strands-agents-tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordaws.amazon.comgithub.com
Oct 28, 2026Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a mCVE-2026-106484 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comMedium 4.4
Insufficient policy enforcement in chrome-devtools-mcp in Google Chrome on Linux prior to 1.5.0 allowed a local attacker to perform arbitrary read/write via a malicious file. (Chromium security severity: Medium)
- Product
- chrome-devtools-mcp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows CVE-2026-118038 · Other software · Progress Software · reported by security@progress.comHigh 7.1
In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated attacker with low privileges who can supply tool arguments to read files outside the configured output directory, and to overwrite such files where they are writable, via relative file paths that resolve against the process current working directory.
- Product
- Telerik Document Processing Libraries
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2026Royal MCP: Does not perform object-level or post-type authorisation checks in one of its search toolsCVE-2026-111960 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Royal MCP WordPress plugin before 1.5.10 does not perform object-level or post-type authorisation checks in one of its search tools, allowing authenticated users such as a subscriber to disclose the title and content of non-public entries, including personal data stored by a companion Royal MCP WordPress plugin before 1.5.10.
- Product
- Royal MCP
- Fixed in
- 1.5.10
- What to do
- Update Royal MCP to 1.5.10 or newer.
Oct 28, 2026Rank Math SEO – AI SEO Tools to Dominate SEO Rankings: PHP Object InjectionCVE-2026-1928 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.276 via deserialization of untrusted input in the updateMeta REST API endpoint. This makes it possible forauthenticated attackers, with Contributor-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to achieve remote code execution by writing a webshell to the uploads directory.
- Product
- Rank Math SEO – AI SEO Tools to Dominate SEO Rankings
- Affected
- up to 1.0.276
- What to do
- Affects up to 1.0.276. Update Rank Math SEO – AI SEO Tools to Dominate SEO Rankings to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 27, 2026GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.CVE-2026-118384 · Other software · GNU · reported by MITREMedium 6.1
GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c.
- Product
- mtools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A vulnerability was found in reduxjs redux-devtools 5.0.0.CVE-2026-117526 · Other software · reduxjs · reported by VulDBLow 1.9
A vulnerability was found in reduxjs redux-devtools 5.0.0. Affected by this vulnerability is the function evalAction of the component Remotedev Server. The manipulation of the argument action results in code injection. The attack is only possible with local access. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.
- Product
- redux-devtools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.CVE-2026-108333 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Low 2.5
Tanium addressed a use-after-free vulnerability in Threat Response Client Extension.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.CVE-2026-108332 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.3
Tanium addressed an improper link resolution before file access vulnerability in Threat Response Client Extension.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.CVE-2026-108331 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Low 3.3
Tanium addressed an infinite loop vulnerability in Threat Response Client Extension.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.CVE-2026-108330 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Low 3.6
Tanium addressed an information disclosure vulnerability in Threat Response Client Extension.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.CVE-2026-108326 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 6.5
Tanium addressed an improper certificate validation vulnerability in Stream Client Extension.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension.CVE-2026-108309 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512Medium 5.5
Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed a heap-based buffer overflow vulnerability in Index.CVE-2026-108307 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.8
Tanium addressed a heap-based buffer overflow vulnerability in Index.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed a local privilege escalation vulnerability in End-User Notifications.CVE-2026-108306 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.8
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed a local privilege escalation vulnerability in End-User Notifications.CVE-2026-108305 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.8
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Tanium addressed a local privilege escalation vulnerability in End-User Notifications.CVE-2026-108304 · Other software · Tanium · reported by 3938794e-25f5-4123-a1ba-5cbd7f104512High 7.8
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
- Product
- Endpoint Configuration Toolset Solution
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user.CVE-2026-87897 · Other software · Nextcloud · reported by support@hackerone.comMedium 4.6
A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a recording, which then enables the attacker read/write access to the victim's Whiteboard.
- Product
- whiteboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 27, 2026Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run CVE-2026-117569 · Other software · alishahid74 · reported by VulnCheckHigh 8.5
Kali-GPT through commit a608c74 contains an OS command injection vulnerability in execute_tool() in kali_gpt/tools/mcp_server.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target, ports, domain, wordlist, or url, executed via subprocess.run with shell=True as the MCP server user.
- Product
- kali-gpt
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to corrupt heap memoryCVE-2026-116742 · Other software · samtools · reported by VulnCheckMedium 4.8
HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c that allows attackers to corrupt heap memory by supplying a crafted .gzi index entry count. A count of 0xFFFFFFFF truncates noffs to zero, causing writes past a malloc(0) buffer and an offs[-1] read in bgzf_useek(), resulting in heap corruption or crashes in tools like samtools and bcftools.
- Product
- htslib
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 26, 2026Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass theCVE-2026-116219 · Other software · Dolibarr · reported by VulnCheckHigh 8.6
Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrict_os_commands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename to execute operating system commands as the web server user.
- Product
- dolibarr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 25, 2026YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attaCVE-2026-116204 · Other software · YesWiki · reported by VulnCheckHigh 7.2
YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an administrator's session. Attackers can plant an auto-submitting raw HTML form on a wiki page, so an administrator who views it posts clean, suppr[], or rev[] parameters that delete PagePrincipale, configuration pages, or overwrite current content.
- Product
- yeswiki
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 23, 2026Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP.CVE-2026-58497 · Other software · olo-dot-io · reported by GitHubHigh 8.6
Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCP. Prior to version 0.225.2, Uni-CLI exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-RPC body to the dispatcher. If the user had started the local MCP HTTP transport, that page could drive tools/call requests against the user's local Uni-CLI server. The Streamable HTTP transport already enforced this browser-to-localhost boundary. The legacy stateless HTTP path did not, so the two HTTP transports had drifted. This issue is about the browser-to-localhost boundary; it does not change Uni-CLI's local-code-execution trust model. This issue has been patched in version 0.225.2.
- Product
- Uni-CLI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 23, 2026An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.CVE-2026-106765 · Other software · reported by MITREHigh 7.5
An issue in @rog0x/mcp-docker-tools 1.0.1 allows a remote attacker to execute arbitrary code via the handleImageList function.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comstillosdigitalholdings.com
Oct 23, 2026An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.CVE-2026-106764 · Other software · reported by MITREHigh 7.5
An issue in @rog0x/mcp-git-tools 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comstillosdigitalholdings.com
Oct 21, 2026Tailored Tools: Cross-Site Request Forgery (CSRF)CVE-2026-111401 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Cross-Site Request Forgery (CSRF) vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site Request Forgery.This issue affects Tailored Tools: from n/a through 3.0.3.
- Product
- Tailored Tools
- Affected
- up to 3.0.3
- What to do
- Affects up to 3.0.3. Update Tailored Tools to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause aCVE-2025-60469 · Other software · reported by MITREMedium 5.5
A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset.CVE-2026-114386 · Other software · pydantic · reported by VulnCheckMedium 6.3
Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode toolset. Users or prompt-injected content can make the sandboxed program invoke tools via run_nested_call() without check_before_tool_call, exceeding operator limits on costly or side-effecting tools.
- Product
- pydantic-ai-harness
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Remote Diagnostic Agent).CVE-2026-91617 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.5
Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Remote Diagnostic Agent). Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Middleware Common Libraries and Tools executes to compromise Oracle Middleware Common Libraries and Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Middleware Common Libraries and Tools accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
- Product
- Oracle Middleware Common Libraries and Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Remote Diagnostic Agent).CVE-2026-91616 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 3.7
Vulnerability in the Oracle Middleware Common Libraries and Tools product of Oracle Fusion Middleware (component: Remote Diagnostic Agent). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Middleware Common Libraries and Tools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle Middleware Common Libraries and Tools accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N).
- Product
- Oracle Middleware Common Libraries and Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution).CVE-2026-91519 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Report Distribution). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
- Product
- PeopleSoft Enterprise PeopleTools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Porting).CVE-2026-91505 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Porting). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized access to critical data or complete access to all PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).
- Product
- PeopleSoft Enterprise PeopleTools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt).CVE-2026-91497 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.3
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).
- Product
- PeopleSoft Enterprise PeopleTools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: QAS).CVE-2026-91468 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: QAS). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L).
- Product
- PeopleSoft Enterprise PeopleTools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX).CVE-2026-91455 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 5.4
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).CVE-2026-91384 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with network access via JDENET to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC).CVE-2026-91383 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.6
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 6.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:N).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDK tools).CVE-2026-91379 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 4.7
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JDK tools). Supported versions that are affected are Oracle Java SE: 8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 27; Oracle GraalVM for JDK: 17.0.20.1 and 21.0.12.1; Oracle GraalVM Enterprise Edition: 21.3.19.1.1. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox
- Product
- Oracle Java SE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91330 · Other software · Oracle Corporation · reported by secalert_us@oracle.comLow 3.3
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 3.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91329 · Other software · Oracle Corporation · reported by secalert_us@oracle.comMedium 6.5
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 6.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC).CVE-2026-91328 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.8
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Deployment SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91327 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Difficult to exploit vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91326 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91325 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91315 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.8
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91314 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.8
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).CVE-2026-91313 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.1
Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.4. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
- Product
- JD Edwards EnterpriseOne Tools
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.