PULSEUnderground Intel

EN VIVO8señales / 24h

FEED

ransomemperador reclama a AB InBev · BE · Agriculture and Food Productionransomwhitearmor reclama a Hisense · CN · Technologyransomanubis reclama a Newcomer Cremations, Funerals & Receptions · US · Healthcareransomqilin reclama a Castle Howard Estate · GB · Hospitalityransomlamashtu reclama a Vins Viallet · FR · Retail & E-Commerceransomemperador reclama a Phoenix S&S GmbH · DE · Manufacturingransomemperador reclama a Frommann Energie GmbH · DE · Energy & Utilitiesransomqilin reclama a SLTN Inter Access · NL · Not Foundransomkrybit reclama a www.choicegoodwill.com · US · Retail & E-Commerceransomkrybit reclama a mainplace.com.my · MY · Retail & E-Commerceransomkrybit reclama a MODON Developments S.A.E · EG · Manufacturingransomkrybit reclama a www.zhservices.com · Professional Servicesransomkrybit reclama a grupoeuro.com.mx · MX · Manufacturingransomkrybit reclama a www.optika.ca · CA · Technologyransomemperador reclama a AB InBev · BE · Agriculture and Food Productionransomwhitearmor reclama a Hisense · CN · Technologyransomanubis reclama a Newcomer Cremations, Funerals & Receptions · US · Healthcareransomqilin reclama a Castle Howard Estate · GB · Hospitalityransomlamashtu reclama a Vins Viallet · FR · Retail & E-Commerceransomemperador reclama a Phoenix S&S GmbH · DE · Manufacturingransomemperador reclama a Frommann Energie GmbH · DE · Energy & Utilitiesransomqilin reclama a SLTN Inter Access · NL · Not Foundransomkrybit reclama a www.choicegoodwill.com · US · Retail & E-Commerceransomkrybit reclama a mainplace.com.my · MY · Retail & E-Commerceransomkrybit reclama a MODON Developments S.A.E · EG · Manufacturingransomkrybit reclama a www.zhservices.com · Professional Servicesransomkrybit reclama a grupoeuro.com.mx · MX · Manufacturingransomkrybit reclama a www.optika.ca · CA · Technology

← Todos los CVEs

CVE Watch22 oct 2026

CVE-2026-70758

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is aff

CVSS

5.3

Medio

EPSS

0.1%

p2

KEV

—

Exploit Today

1

0-100

Publicado: 18 ago 2026 · Última mod.: 22 oct 2026 · CWE-284

EPSS · 30d

0.1%EPSS · 30 días0.1%

2026-09-262026-10-23

Descripción técnica

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Hyperion Financial Reporting executes to compromise Oracle Hyperion Financial Reporting. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Financial Reporting accessible data as well as unauthorized read access to a subset of Oracle Hyperion Financial Reporting accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N).

Referencias oficiales

www.oracle.comhttps://www.oracle.com/security-alerts/cspuaug2026.html

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1160446.3 MED

———A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php of the component Remote URL File Upload Module. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.5h CVE-2026-878356.5 MED

——0The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the Front End Users WordPress plugin through 3.2.35's content restrictions and its registration gating.20h CVE-2026-1136743.7 BAJ

——0The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.20h CVE-2026-1060733.3 BAJ

——0A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.2d CVE-2026-1060713.6 BAJ

——0A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043. This vulnerability affects Node.js **26.x**.2d CVE-2026-1054827.4 ALT

——0A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.2d