PULSE
EN
FEED
ransomqilin reclama a SLTN Inter Access · NL · Not Foundransomkrybit reclama a www.choicegoodwill.com · US · Retail & E-Commerceransomkrybit reclama a mainplace.com.my · MY · Retail & E-Commerceransomkrybit reclama a MODON Developments S.A.E · EG · Manufacturingransomkrybit reclama a www.zhservices.com · Professional Servicesransomkrybit reclama a grupoeuro.com.mx · MX · Manufacturingransomkrybit reclama a www.optika.ca · CA · Technologyransomn0n reclama a Texcar Inc. · Manufacturingransomn0n reclama a GPIC Projectos Con Instalacoes Lda · PT · Manufacturingransomn0n reclama a Asisken Asistencia Médica S.A. · AR · Healthcareransomn0n reclama a Adirondack Networks, Inc. · US · Technologyransomn0n reclama a Arthritis Center of Riverside · US · Healthcareransomthegentlemen reclama a Red Oak Technologies · US · Technologyransomthegentlemen reclama a Penco Products · US · Manufacturingransomqilin reclama a SLTN Inter Access · NL · Not Foundransomkrybit reclama a www.choicegoodwill.com · US · Retail & E-Commerceransomkrybit reclama a mainplace.com.my · MY · Retail & E-Commerceransomkrybit reclama a MODON Developments S.A.E · EG · Manufacturingransomkrybit reclama a www.zhservices.com · Professional Servicesransomkrybit reclama a grupoeuro.com.mx · MX · Manufacturingransomkrybit reclama a www.optika.ca · CA · Technologyransomn0n reclama a Texcar Inc. · Manufacturingransomn0n reclama a GPIC Projectos Con Instalacoes Lda · PT · Manufacturingransomn0n reclama a Asisken Asistencia Médica S.A. · AR · Healthcareransomn0n reclama a Adirondack Networks, Inc. · US · Technologyransomn0n reclama a Arthritis Center of Riverside · US · Healthcareransomthegentlemen reclama a Red Oak Technologies · US · Technologyransomthegentlemen reclama a Penco Products · US · Manufacturing
← Todos los CVEs
CVE Watch28 jul 2026

CVE-2026-60144

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that

CVSS

3.6

Bajo

EPSS

0.1%

p1

KEV

—

Exploit Today

0

0-100

Publicado: 21 jul 2026 · Última mod.: 28 jul 2026 · CWE-284

EPSS · 30d
0.1%EPSS · 30 días0.1%
2026-09-252026-10-23
Descripción técnica

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Workflow executes to compromise Oracle Workflow. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Workflow accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Workflow. CVSS 3.1 Base Score 3.6 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L).

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1060733.3 BAJ
—
——0A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.22hCVE-2026-1060713.6 BAJ
—
——0A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043. This vulnerability affects Node.js **26.x**.22hCVE-2026-1054827.4 ALT
—
——0A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.22hCVE-2026-957047.2 ALT
26.5%
——8A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying operating system, potentially compromising system integrity and data security.14hCVE-2026-1153767.7 ALT
18.7%
——6Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows project-restricted clients to copy volumes by omitting source.type. Attackers can send crafted POST requests to the custom volumes endpoint with a chosen source.project to copy and read other projects' volumes, snapshots, and configuration.1dCVE-2026-1145744.3 MED
22.6%
——7A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of the component Local HTTP Service. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The name of the patch is d25d8fa3f5a1e34285c8634f18729650c0c05cda. It is advisable to implement a patch to correct this issue.2d