PULSEUnderground Intel

EN VIVO27señales / 24h

FEED

ransomqilin reclama a Arthur Chapman Kettering Smetak Pikala PA · US · Professional Servicesransomakira reclama a Bison Bag · Retail & E-Commerceransomakira reclama a SK Global Software · KR · Technologyransomakira reclama a Pelham Plastics · Manufacturingransomsilentransomgroup reclama a G... R...ransombooba project reclama a Boardman Park · GB · Otherransombooba project reclama a Vetstoria · SE · Healthcareransombooba project reclama a City of Edgewater · US · Government & Defenseransombooba project reclama a DROUIN SAS · FR · Manufacturingransomn0n reclama a Company #127 · SAransomn0n reclama a Company #126ransomn0n reclama a Company #125 · USransomn0n reclama a Company #124 · USransomn0n reclama a Company #123 · USransomqilin reclama a Arthur Chapman Kettering Smetak Pikala PA · US · Professional Servicesransomakira reclama a Bison Bag · Retail & E-Commerceransomakira reclama a SK Global Software · KR · Technologyransomakira reclama a Pelham Plastics · Manufacturingransomsilentransomgroup reclama a G... R...ransombooba project reclama a Boardman Park · GB · Otherransombooba project reclama a Vetstoria · SE · Healthcareransombooba project reclama a City of Edgewater · US · Government & Defenseransombooba project reclama a DROUIN SAS · FR · Manufacturingransomn0n reclama a Company #127 · SAransomn0n reclama a Company #126ransomn0n reclama a Company #125 · USransomn0n reclama a Company #124 · USransomn0n reclama a Company #123 · US

← Todos los CVEs

CVE Watch22 sept 2026

CVE-2026-83004

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions

CVSS

7.2

Alto

EPSS

0.1%

p2

KEV

—

Exploit Today

1

0-100

Publicado: 15 sept 2026 · Última mod.: 22 sept 2026 · CWE-284

EPSS · 30d

0.1%EPSS · 30 días0.1%

2026-10-062026-11-02

Descripción técnica

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle WebCenter Enterprise Capture executes to compromise Oracle WebCenter Enterprise Capture. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Enterprise Capture accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Enterprise Capture accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N).

Referencias oficiales

www.oracle.comhttps://www.oracle.com/security-alerts/cspusep2026.html

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1215396.3 MED

———A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.38. Affected by this issue is the function CheckPassword of the file app/src/server.js of the component Socket IO Handler. Performing a manipulation of the argument peer_id results in improper access controls. It is possible to initiate the attack remotely. Upgrading to version 2.1.39 can resolve this issue. The patch is named 4e40471abc48bfc32b4b174b8844716dfc5c1471. You should upgrade the affected component.48m CVE-2026-1215095.3 MED

———A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.48m CVE-2026-1214167.1 ALT

———SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or $f.put()/$f.get() to write and read file bucket data despite file::* denials.5h CVE-2026-169007.5 ALT

——0Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request.4h CVE-2026-135949.1 CRÍ

——0Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.4h CVE-2026-1205033.3 BAJ

——0A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 1.8.1 is able to mitigate this issue. The patch is identified as 9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e. Upgrading the affected component is recommended.1d