PULSEUnderground Intel

EN VIVO27señales / 24h

FEED

ransomemperador reclama a Afflelou · FR · Retail & E-Commerceransombyod reclama a University of New Mexico · US · Educationransomrhysida reclama a MISC Group · MY · Energy & Utilitiesransomn0n reclama a Ingelectus Innovative Electrical Solutions S.L. · ES · Energy & Utilitiesransomwhitearmor reclama a Gamdom · Otherransomfalcon reclama a Beasley Allen Law Firm · US · Professional Servicesransomqilin reclama a RaceTrakka · AU · Retail & E-Commerceransomqilin reclama a Smith Feddeler & Smith · US · Professional Servicesransomqilin reclama a Delta Electric Power Association · US · Energy & Utilitiesransomqilin reclama a Bangor Wholesale Laminates · GB · Manufacturingransomqilin reclama a TeleTronic · ES · Technologyransomqilin reclama a FIRMENGRUPPE APPL Holding GmbH · DE · Otherransomqilin reclama a Premier Medical Group · US · Healthcareransomqilin reclama a Zachary Confections · US · Retail & E-Commerceransomemperador reclama a Afflelou · FR · Retail & E-Commerceransombyod reclama a University of New Mexico · US · Educationransomrhysida reclama a MISC Group · MY · Energy & Utilitiesransomn0n reclama a Ingelectus Innovative Electrical Solutions S.L. · ES · Energy & Utilitiesransomwhitearmor reclama a Gamdom · Otherransomfalcon reclama a Beasley Allen Law Firm · US · Professional Servicesransomqilin reclama a RaceTrakka · AU · Retail & E-Commerceransomqilin reclama a Smith Feddeler & Smith · US · Professional Servicesransomqilin reclama a Delta Electric Power Association · US · Energy & Utilitiesransomqilin reclama a Bangor Wholesale Laminates · GB · Manufacturingransomqilin reclama a TeleTronic · ES · Technologyransomqilin reclama a FIRMENGRUPPE APPL Holding GmbH · DE · Otherransomqilin reclama a Premier Medical Group · US · Healthcareransomqilin reclama a Zachary Confections · US · Retail & E-Commerce

← Todos los CVEs

CVE Watch24 oct 2026

CVE-2026-61120

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affe

CVSS

7.0

Alto

EPSS

0.1%

p3

KEV

—

Exploit Today

1

0-100

Publicado: 21 jul 2026 · Última mod.: 24 oct 2026 · CWE-269

EPSS · 30d

0.1%EPSS · 30 días0.1%

2026-09-282026-10-25

Descripción técnica

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS (US) executes to compromise Oracle HRMS (US). Successful attacks of this vulnerability can result in takeover of Oracle HRMS (US). CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Referencias oficiales

www.oracle.comhttps://www.oracle.com/security-alerts/cpujul2026.html

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1139478.8 ALT

———This issue was addressed with improved access restrictions. This issue is fixed in macOS Golden Gate 27.2. Unpacking a maliciously crafted archive may lead to unexpected app termination or arbitrary code execution.6h CVE-2026-1164714.3 MED

———A security flaw has been discovered in BKWLD Decoy up to 5.11.1. The impacted element is an unknown function of the file Policy.php of the component Authorization Policy. The manipulation of the argument role results in improper privilege management. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.8h CVE-2026-1162236.5 MED

——0A flaw has been found in icret EasyImage up to 2.8.7. The impacted element is an unknown function of the file app/del.php. Executing a manipulation of the argument hash can lead to improper privilege management. The attack can be launched remotely. The exploit has been published and may be used. This patch is called b12cb67d447bcbb67e21c8f011d0f5638229760c. A patch should be applied to remediate this issue.14h CVE-2026-116162—

——0Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the email-verification flag or beforeSave-protected values.13h CVE-2026-1152517.2 ALT

——2The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory.14h CVE-2026-1152149.8 CRÍ

——1The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.14h