PULSEUnderground Intel

EN VIVO19señales / 24h

FEED

ransomqilin reclama a Mountain Rheumatology · US · Healthcareransomqilin reclama a Taubensee Steel & Wire · DE · Manufacturingransomqilin reclama a Natural Energy Laboratory of Hawaii Authority · US · Energy & Utilitiesransomqilin reclama a Miller Stratvert · USransomqilin reclama a Seufert Construction · US · Manufacturingransomemperador reclama a TRANSPORTES JIMENEZ and REYES JIM REY S.A. · MX · Transportationransomdoommageddon reclama a Referans Lab Ref-Lab · TR · Technologyransomaurora reclama a Ernesto Malvestiti S.p.A. · IT · Manufacturingransomdragonforce reclama a Inside Passage Electric Cooperative, Inc · US · Energy & Utilitiesransomscarlettgroup reclama a mahsing.com.my · MY · Hospitalityransomwhitearmor reclama a LoveSac · US · Retail & E-Commerceransompayload reclama a Glückauf-Vermessung GmbH · DE · Professional Servicesransompayload reclama a Miletic GmbH · DEransompayload reclama a Edelstahl-Mechanik GmbH · DE · Manufacturingransomqilin reclama a Mountain Rheumatology · US · Healthcareransomqilin reclama a Taubensee Steel & Wire · DE · Manufacturingransomqilin reclama a Natural Energy Laboratory of Hawaii Authority · US · Energy & Utilitiesransomqilin reclama a Miller Stratvert · USransomqilin reclama a Seufert Construction · US · Manufacturingransomemperador reclama a TRANSPORTES JIMENEZ and REYES JIM REY S.A. · MX · Transportationransomdoommageddon reclama a Referans Lab Ref-Lab · TR · Technologyransomaurora reclama a Ernesto Malvestiti S.p.A. · IT · Manufacturingransomdragonforce reclama a Inside Passage Electric Cooperative, Inc · US · Energy & Utilitiesransomscarlettgroup reclama a mahsing.com.my · MY · Hospitalityransomwhitearmor reclama a LoveSac · US · Retail & E-Commerceransompayload reclama a Glückauf-Vermessung GmbH · DE · Professional Servicesransompayload reclama a Miletic GmbH · DEransompayload reclama a Edelstahl-Mechanik GmbH · DE · Manufacturing

← Todos los CVEs

CVE Watch24 oct 2026

CVE-2026-91455

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versio

CVSS

5.4

Medio

EPSS

0.2%

p13

KEV

—

Exploit Today

4

0-100

Publicado: 20 oct 2026 · Última mod.: 24 oct 2026 · CWE-601

EPSS · 30d

0.2%EPSS · 30 días0.2%

2026-10-212026-10-25

Descripción técnica

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of JD Edwards EnterpriseOne Tools accessible data as well as unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N).

Referencias oficiales

www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2026.html

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1155374.3 MED

——8A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function simpan of the file application/modules/admin/controllers/routing_pages.php of the component URL Validation. This manipulation of the argument url_route causes open redirect. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.3d CVE-2026-1146142.6 BAJ

——2Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.is_secure_transport() uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host is an external non-loopback system. An external party able to supply a URL to OIDC RP-Initiated Logout registration, authorization-server metadata validation, or another call site can bypass the TLS-required guard and cause cleartext redirection or acceptance of cleartext endpoints. The issue does not bypass redirect URI exact matching and does not by itself forge tokens or authenticate users. The vulnerable authlib.common.security.is_secure_transport() implementation in authlib/common/security.py misinterprets the userinfo component before OIDC RP-Initiated Logout dynamic client registration and other consumers enforce transport security. This issue is fixed in version 1.8.0.3d CVE-2026-1153604.7 MED

——5OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft.3d CVE-2026-87945—

——4URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the Source of Data. This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.5d CVE-2026-87937—

——6URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server allows Fake the Source of Data. This issue affects Central Authentication System (CAS) Server versions: from 0.0.0 to 2.0.4, from 2.1.0 to 2.1.3.5d CVE-2024-49895.4 MED

——2The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by malicious actors. Exploitation of this vulnerability could lead to users being redirected to attacker-controlled web pages. This can be used in conjunction with social engineering techniques to trick users into interacting with malicious links, potentially resulting in phishing attacks aimed at acquiring sensitive information or causing other harm.5d