PULSE
EN
FEED
ransomsafepay reclama a quevedo-ponce.com · EC · Otherransomsafepay reclama a mars-semi.com.tw · TW · Manufacturingransomsafepay reclama a Rood Trucking · US · Transportationransomsafepay reclama a grifosespinoza.com · PE · Otherransomsafepay reclama a jumonji-u.ac.jp · JP · Educationransomsafepay reclama a everon.com.ar · AR · Otherransomsafepay reclama a goldencrops.com.tw · TW · Agriculture and Food Productionransomsafepay reclama a layam.com · ILransomsafepay reclama a uaa.mx · MX · Educationransomn0n reclama a Digital Triumph · MY · Technologyransomthegentlemen reclama a First Dental · US · Healthcareransomthegentlemen reclama a Angeles Contractor · MX · Manufacturingransomthegentlemen reclama a SK Capital Partners · US · Financial Servicesransomthegentlemen reclama a Cherry Bekaert · US · Professional Servicesransomsafepay reclama a quevedo-ponce.com · EC · Otherransomsafepay reclama a mars-semi.com.tw · TW · Manufacturingransomsafepay reclama a Rood Trucking · US · Transportationransomsafepay reclama a grifosespinoza.com · PE · Otherransomsafepay reclama a jumonji-u.ac.jp · JP · Educationransomsafepay reclama a everon.com.ar · AR · Otherransomsafepay reclama a goldencrops.com.tw · TW · Agriculture and Food Productionransomsafepay reclama a layam.com · ILransomsafepay reclama a uaa.mx · MX · Educationransomn0n reclama a Digital Triumph · MY · Technologyransomthegentlemen reclama a First Dental · US · Healthcareransomthegentlemen reclama a Angeles Contractor · MX · Manufacturingransomthegentlemen reclama a SK Capital Partners · US · Financial Servicesransomthegentlemen reclama a Cherry Bekaert · US · Professional Services
← Todos los CVEs
CVE Watch24 oct 2026

CVE-2026-60642

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are

CVSS

7.6

Alto

EPSS

0.2%

p4

KEV

—

Exploit Today

1

0-100

Publicado: 21 jul 2026 · Última mod.: 24 oct 2026 · CWE-284 · CWE-352 · CWE-601

EPSS · 30d
0.2%EPSS · 30 días0.2%
2026-10-022026-10-30
Descripción técnica

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle WebCenter Content. CVSS 3.1 Base Score 7.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L).

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-115828—
—
——0In Secret Server versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device17hCVE-2026-1196207.3 ALT
—
——0A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move_uploaded_file of the file admin/add_logs.php. Executing a manipulation of the argument File can lead to unrestricted upload. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.18hCVE-2025-85748.7 ALT
—
——0The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and including, 1.4.7. This is due to a lack of restriction on database tables that can be deleted. This makes it possible for authenticated attackers, with Administrator-level access and above, to delete core WordPress tables.18hCVE-2026-655668.8 ALT
—
——0Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This issue affects AI Engine: from n/a through 3.8.8.19hCVE-2026-6182610.0 CRÍ
—
——0Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke `POST /api/plex/oauth/logout` to clear credentials and disable the integration, or `POST /api/plex/apikey` to persist an attacker-selected key, without a PIN, account or state precondition. `POST /api/plex/oauth/pin` and `GET /api/plex/oauth/pin/<pin_id>/check` additionally allow an attacker who completes a PIN with an attacker-controlled Plex account to bind that account's token to the instance. `PlexPinCheck` skips state validation when `state_param` is absent and merely logs a mismatch without stopping execution. `POST /api/plex/select-server`, `POST /api/plex/oauth/servers`, `POST /api/plex/webhook/create`, `POST /api/plex/webhook/delete` and `POST /api/plex/encrypt-apikey` expose further `write_config()` operations. Attacker-controlled server URLs feed later outbound requests carrying the configured API key in `X-Plex-Token`, enabling server-side request forgery and credential exposure in addition to persistent configuration tampering and integration denial of service. Version 1.5.7-beta.14 closes the anonymous API-mutation path by adding authentication; complete OAuth state validation is not established and remains a separate residual for curator review.18hCVE-2026-1194665.4 MED
—
——0Cross-Site Request Forgery (CSRF) vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Cross Site Request Forgery.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.5.20h