PULSEUnderground Intel

EN VIVO21señales / 24h

FEED

ransomanubis reclama a Santiam Hospital & Clinics · US · Healthcareransomsilentransomgroup reclama a Lowenstein Sandler LLP · US · Professional Servicesransompear reclama a Cyrious Software · US · Technologyransomwallstreet reclama a Fortrex · US · Manufacturingransomsilentransomgroup reclama a Morrison Foerster · US · Professional Servicesransomsilentransomgroup reclama a T... E...ransomsilentransomgroup reclama a S... H...ransomgenesis reclama a A&B Lab · US · Otherransomglobal secret group reclama a The Anglican International School · IL · Educationransompanzer reclama a PQE Group · Professional Servicesransomsilentransomgroup reclama a L...ransomrhysida reclama a Noelker and Hull · US · Professional Servicesransompayload reclama a Hauhinco · DE · Manufacturingransompayload reclama a Marbre Design · Manufacturingransomanubis reclama a Santiam Hospital & Clinics · US · Healthcareransomsilentransomgroup reclama a Lowenstein Sandler LLP · US · Professional Servicesransompear reclama a Cyrious Software · US · Technologyransomwallstreet reclama a Fortrex · US · Manufacturingransomsilentransomgroup reclama a Morrison Foerster · US · Professional Servicesransomsilentransomgroup reclama a T... E...ransomsilentransomgroup reclama a S... H...ransomgenesis reclama a A&B Lab · US · Otherransomglobal secret group reclama a The Anglican International School · IL · Educationransompanzer reclama a PQE Group · Professional Servicesransomsilentransomgroup reclama a L...ransomrhysida reclama a Noelker and Hull · US · Professional Servicesransompayload reclama a Hauhinco · DE · Manufacturingransompayload reclama a Marbre Design · Manufacturing

← Todos los CVEs

CVE Watch26 oct 2026

CVE-2026-46913

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions tha

CVSS

9.3

Crítico

EPSS

0.1%

p3

KEV

—

Exploit Today

1

0-100

Publicado: 17 jun 2026 · Última mod.: 26 oct 2026 · CWE-284

EPSS · 30d

0.1%EPSS · 30 días0.2%

2026-09-302026-10-27

Descripción técnica

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where JD Edwards EnterpriseOne Tools executes to compromise JD Edwards EnterpriseOne Tools. While the vulnerability is in JD Edwards EnterpriseOne Tools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Referencias oficiales

www.oracle.comhttps://www.oracle.com/security-alerts/cspujun2026.html

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1185784.3 MED

———A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.8. The affected element is an unknown function of the component Request Forwarder. The manipulation results in information disclosure. The attack can only be performed from the local network. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.5h CVE-2026-118662—

———Vite is a frontend tooling framework for JavaScript. From 6.4.4 until 6.4.5, the Vite development server can evaluate server.fs.deny before stripping loader query parameters such as ?raw, ?import&raw, or ?import&url&inline. When the development server is exposed to the network and a sensitive file is inside server.fs.allow but matched by server.fs.deny, an unauthenticated attacker can append one of these queries and retrieve the denied file. This issue is fixed in version 6.4.5.7h CVE-2026-670738.6 ALT

———HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise.14h CVE-2026-1152555.3 MED

——0The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to delete the WordPress user accounts of roster members.10h CVE-2026-1060035.3 MED

——0The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJAX actions, allowing unauthenticated users to add or delete reservation types in the Court Reservation WordPress plugin before 1.12.4's configuration.10h CVE-2026-1033825.3 MED

——0The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used to verify them is empty on a default installation, allowing unauthenticated attackers to forge a notification and mark any pending WooCommerce order as paid, regardless of its payment method.10h