PULSEUnderground Intel

EN VIVO16señales / 24h

FEED

ransomaurora reclama a Ernesto Malvestiti S.p.A. · IT · Manufacturingransomdragonforce reclama a Inside Passage Electric Cooperative, Inc · US · Energy & Utilitiesransomscarlettgroup reclama a mahsing.com.my · MY · Hospitalityransomwhitearmor reclama a LoveSac · US · Retail & E-Commerceransompayload reclama a Glückauf-Vermessung GmbH · DE · Professional Servicesransompayload reclama a Miletic GmbH · DEransompayload reclama a Edelstahl-Mechanik GmbH · DE · Manufacturingransomwhitearmor reclama a J.B Hunt · US · Transportationransompanzer reclama a Yodingenierie · BJ · Professional Servicesransomqilin reclama a White & Case · US · Professional Servicesransomqilin reclama a Hossner-Textil GmbH · DE · Manufacturingransomwhitearmor reclama a Partido Liberal · AR · Government & Defenseransomqilin reclama a Ooredoo Myanmar · MM · Technologyransomfalcon reclama a Weitz & Luxenberg · US · Professional Servicesransomaurora reclama a Ernesto Malvestiti S.p.A. · IT · Manufacturingransomdragonforce reclama a Inside Passage Electric Cooperative, Inc · US · Energy & Utilitiesransomscarlettgroup reclama a mahsing.com.my · MY · Hospitalityransomwhitearmor reclama a LoveSac · US · Retail & E-Commerceransompayload reclama a Glückauf-Vermessung GmbH · DE · Professional Servicesransompayload reclama a Miletic GmbH · DEransompayload reclama a Edelstahl-Mechanik GmbH · DE · Manufacturingransomwhitearmor reclama a J.B Hunt · US · Transportationransompanzer reclama a Yodingenierie · BJ · Professional Servicesransomqilin reclama a White & Case · US · Professional Servicesransomqilin reclama a Hossner-Textil GmbH · DE · Manufacturingransomwhitearmor reclama a Partido Liberal · AR · Government & Defenseransomqilin reclama a Ooredoo Myanmar · MM · Technologyransomfalcon reclama a Weitz & Luxenberg · US · Professional Services

← Todos los CVEs

CVE Watch22 oct 2026

CVE-2026-91497

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). Supported versio

CVSS

5.3

Medio

EPSS

0.3%

p20

KEV

—

Exploit Today

6

0-100

Publicado: 20 oct 2026 · Última mod.: 22 oct 2026 · CWE-284

EPSS · 30d

0.3%EPSS · 30 días0.3%

2026-10-212026-10-25

Descripción técnica

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Mgmt). Supported versions that are affected are 8.61-8.63. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N).

Referencias oficiales

www.oracle.comhttps://www.oracle.com/security-alerts/cpuoct2026.html

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-1162367.2 ALT

———A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.4h CVE-2026-1033816.5 MED

———The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information.2h CVE-2026-1032985.3 MED

———The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment.2h CVE-2026-1161223.7 BAJ

———A security flaw has been discovered in NocoDB up to 2026.07.0. Impacted is the function AuthService.validateUser of the component Sign-in Endpoint. Performing a manipulation of the argument salt results in information disclosure. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitability is considered difficult. The vendor deleted the GitHub issue for this vulnerability without any explanation. Afterwards the vendor was contacted early about this disclosure via email but did not respond in any way.7h CVE-2026-1161136.3 MED

———A security flaw has been discovered in GouGuOA up to 6.1.2. The impacted element is the function chunkUpload of the file app/disk/controller/Api.php. The manipulation of the argument file_extension results in unrestricted upload. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.9h CVE-2026-1161084.3 MED

———A flaw has been found in openbq-org OpenBB up to 4.7.2/5.0.0. This affects an unknown part of the file openbb_platform/core/openbb_core/app/model/api_settings.py of the component Local API Server. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.11h