PULSEUnderground Intel

EN VIVO21señales / 24h

FEED

ransomwhitearmor reclama a Hisense · CN · Technologyransomanubis reclama a Newcomer Cremations, Funerals & Receptions · US · Healthcareransomqilin reclama a Castle Howard Estate · GB · Hospitalityransomlamashtu reclama a Vins Viallet · FR · Retail & E-Commerceransomemperador reclama a Phoenix S&S GmbH · DE · Manufacturingransomemperador reclama a Frommann Energie GmbH · DE · Energy & Utilitiesransomqilin reclama a SLTN Inter Access · NL · Not Foundransomkrybit reclama a www.choicegoodwill.com · US · Retail & E-Commerceransomkrybit reclama a mainplace.com.my · MY · Retail & E-Commerceransomkrybit reclama a MODON Developments S.A.E · EG · Manufacturingransomkrybit reclama a www.zhservices.com · Professional Servicesransomkrybit reclama a grupoeuro.com.mx · MX · Manufacturingransomkrybit reclama a www.optika.ca · CA · Technologyransomn0n reclama a Texcar Inc. · Manufacturingransomwhitearmor reclama a Hisense · CN · Technologyransomanubis reclama a Newcomer Cremations, Funerals & Receptions · US · Healthcareransomqilin reclama a Castle Howard Estate · GB · Hospitalityransomlamashtu reclama a Vins Viallet · FR · Retail & E-Commerceransomemperador reclama a Phoenix S&S GmbH · DE · Manufacturingransomemperador reclama a Frommann Energie GmbH · DE · Energy & Utilitiesransomqilin reclama a SLTN Inter Access · NL · Not Foundransomkrybit reclama a www.choicegoodwill.com · US · Retail & E-Commerceransomkrybit reclama a mainplace.com.my · MY · Retail & E-Commerceransomkrybit reclama a MODON Developments S.A.E · EG · Manufacturingransomkrybit reclama a www.zhservices.com · Professional Servicesransomkrybit reclama a grupoeuro.com.mx · MX · Manufacturingransomkrybit reclama a www.optika.ca · CA · Technologyransomn0n reclama a Texcar Inc. · Manufacturing

← Todos los CVEs

CVE Watch23 oct 2026

CVE-2026-91431

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-2

CVSS

5.5

Medio

EPSS

0.1%

p2

KEV

—

Exploit Today

1

0-100

Publicado: 20 oct 2026 · Última mod.: 23 oct 2026 · CWE-284

EPSS · 30d

0.1%EPSS · 30 días0.1%

2026-10-212026-10-23

Descripción técnica

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Siebel CRM End User executes to compromise Siebel CRM End User. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Siebel CRM End User accessible data. CVSS 3.1 Base Score 5.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

Referencias oficiales

www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2026.html

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-878356.5 MED

——0The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the Front End Users WordPress plugin through 3.2.35's content restrictions and its registration gating.15h CVE-2026-1136743.7 BAJ

——0The GeoDirectory WordPress plugin before 2.8.194 does not correctly verify ownership of listings submitted by logged-out users before allowing them to be edited, allowing unauthenticated attackers to modify, unpublish, attach images to, or reassign any guest-submitted listing when guest posting is enabled.15h CVE-2026-1060733.3 BAJ

——0A flaw in Node.js Permission Model filesystem enforcement leaves `fs.realpathSync()` without the required read permission checks. This is an incomplete fix of CVE-2026-21715, which only covered `fs.realpathSync.native()`. As a result, code running under `--permission` with restricted `--allow-fs-read` can still use `fs.realpathSync()` to check file existence, resolve symlink targets, and enumerate filesystem paths outside of permitted directories. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.1d CVE-2026-1060713.6 BAJ

——0A flaw in Node.js Permission Model filesystem enforcement can grant access to paths that do not match a wildcard `--allow-fs-read` or `--allow-fs-write` rule. When the requested path is shorter than the prefix of a wildcard grant, the radix tree lookup stops comparing early and treats the path as a match. For example, `--allow-fs-read=/etc/passwd.*` also allows reading `/etc/passwd`. This requires the wildcard grant to sit directly under the root of the permission tree, for example when it is the only grant for that scope. This is a different root cause from CVE-2026-58043. This vulnerability affects Node.js **26.x**.1d CVE-2026-1054827.4 ALT

——0A flaw in Node.js DNS resolution allows hostnames containing a NUL byte to be silently truncated by the dns.resolve*() functions and dns.reverse(). This is an incomplete fix of CVE-2026-48930, which only covered dns.lookup() and the net/tls host options. Because the name is passed to c-ares as a C string, resolving attacker.example\0.trusted.example queries attacker.example and returns its records without any error. Applications that validate a hostname, for example against a domain allowlist, and then resolve it with dns.resolve*() can act on records for a different name than the one they validated. This vulnerability affects Node.js 26.x, 24.x, and 22.x.1d CVE-2026-957047.2 ALT

——8A vulnerability in the web-based management interface of wireless network management systems could allow an authenticated remote attacker to execute remote code. Successful exploitation could enable an attacker to execute arbitrary commands on the underlying operating system, potentially compromising system integrity and data security.1d