PULSE
EN
FEED
ransomn0n reclama a Company #111 · AEransomeverest reclama a OR Technology · Technologyransomeverest reclama a Burris & MacOmber · Professional Servicesransomeverest reclama a Energy Storage Terminal in Singapore · SG · Energy & Utilitiesransomeverest reclama a Point Robotics · Technologyransomeverest reclama a Natuzzi · IT · Manufacturingransomeverest reclama a TECNA ICE · IT · Manufacturingransomeverest reclama a MediSolution · Healthcareransomeverest reclama a SleepEx LabRetriever · Healthcareransomcrypto24 reclama a Antah HealthCare Group · MY · Healthcareransomcrypto24 reclama a DATEM, Inc. · PH · Technologyransomwhitearmor reclama a gamblinglore · Retail & E-Commerceransomwhitearmor reclama a Verification · Technologyransomulose reclama a zzq-testransomn0n reclama a Company #111 · AEransomeverest reclama a OR Technology · Technologyransomeverest reclama a Burris & MacOmber · Professional Servicesransomeverest reclama a Energy Storage Terminal in Singapore · SG · Energy & Utilitiesransomeverest reclama a Point Robotics · Technologyransomeverest reclama a Natuzzi · IT · Manufacturingransomeverest reclama a TECNA ICE · IT · Manufacturingransomeverest reclama a MediSolution · Healthcareransomeverest reclama a SleepEx LabRetriever · Healthcareransomcrypto24 reclama a Antah HealthCare Group · MY · Healthcareransomcrypto24 reclama a DATEM, Inc. · PH · Technologyransomwhitearmor reclama a gamblinglore · Retail & E-Commerceransomwhitearmor reclama a Verification · Technologyransomulose reclama a zzq-test
← Todos los CVEs
CVE Watch24 oct 2026

CVE-2026-60685

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affec

CVSS

6.1

Medio

EPSS

0.1%

p3

KEV

—

Exploit Today

1

0-100

Publicado: 21 jul 2026 · Última mod.: 24 oct 2026 · CWE-284 · CWE-352 · CWE-601

EPSS · 30d
0.1%EPSS · 30 días0.1%
2026-09-282026-10-25
Descripción técnica

Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupport. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle iSupport accessible data as well as unauthorized read access to a subset of Oracle iSupport accessible data. CVSS 3.1 Base Score 6.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).

Referencias oficiales
CVEs relacionados
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1168397.1 ALT
—
———A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.10hCVE-2026-1168388.8 ALT
—
———A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.10hCVE-2026-1168095.3 MED
—
———OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers to read bot events by only checking shareOverview row existence. Attackers can send anonymous requests with a projectId to retrieve bot-event names, types, and paths for private or password-protected projects, revealing internal routes.11hCVE-2026-1166034.7 MED
—
———A flaw has been found in SourceCodester Online Food Ordering System 1.0. Impacted is an unknown function of the file admin/add_food.php. Executing a manipulation of the argument image can lead to unrestricted upload. The attack may be performed from remote. The exploit has been published and may be used.11hCVE-2026-1165075.3 MED
—
———A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of the file global.so. Such manipulation of the argument token leads to information disclosure. The attack may be launched remotely. The exploit is publicly available and might be used.13hCVE-2026-116578—
—
———Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.14h