CVE Vulnerability Advisory Database

[Affected Scope] Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62

[Impact] Unauthenticated remote attackers can compromise and completely take over the PeopleSoft Enterprise PeopleTools system via HTTP network access

[Mitigation] Immediately apply the official Oracle Critical Patch Update (CPU) and restrict external HTTP access to the affected component

[Affected Scope] Splunk Enterprise versions 10.2.x below 10.2.4 and 10.0.x below 10.0.7 (versions 9.4 and earlier are unaffected)

[Impact] An unauthenticated remote attacker can access the PostgreSQL sidecar service endpoint to create or truncate arbitrary files, potentially leading to Remote Code Execution (RCE)

[Mitigation] Immediately upgrade to patched versions (10.2.4+, 10.0.7+) or disable the PostgreSQL sidecar service if an immediate upgrade is not feasible

[Affected Scope] Vulnerable versions of the JCE (Joomla Content Editor) extension for Joomla CMS

[Impact] Unauthenticated remote attackers can create unauthorized editor profiles, bypass file upload restrictions, and upload malicious PHP scripts to achieve full Remote Code Execution (RCE)

[Mitigation] Immediately upgrade JCE to the latest patched version and deploy Web Application Firewall (WAF) rules to block unauthorized profile modification requests

[Affected Scope] Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, specifically the Oracle Payments (File Transmission) component

[Impact] Unauthenticated remote attackers can bypass authentication via HTTP, leading to complete takeover of the Oracle Payments module

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, and restrict external HTTP access to the Payments module until patched

[Affected Scope] Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12

[Impact] Unauthenticated remote attackers can achieve arbitrary code execution (RCE) on the target server

[Mitigation] Immediately upgrade the Mirasvit Full Page Cache Warmer module to version 1.11.12 or higher, and deploy WAF mitigation rules

[Affected Scope] Microsoft SharePoint Server deployments

[Impact] An authorized attacker can exploit a deserialization of untrusted data vulnerability over the network to execute arbitrary code with server privileges.

[Mitigation] Immediately apply the official security patches provided by Microsoft and restrict network access to SharePoint servers.

[Affected Scope] LiteSpeed User-End cPanel Plugin versions prior to 2.4.5

[Impact] Unauthenticated remote attackers can escalate privileges (potentially to root) by exploiting improper handling of Redis features, with active exploitation observed in the wild.

[Mitigation] Immediately upgrade the plugin to the recommended minimum version of 2.4.7 or higher and perform IoC scanning using the provided command.

[Affected Scope] Drupal core versions 8.9.0 to < 10.4.10, 10.5.0 to < 10.5.10, 10.6.0 to < 10.6.9, 11.0.0 to < 11.1.10, 11.2.0 to < 11.2.12, and 11.3.0 to < 11.3.10

[Impact] Unauthenticated remote attackers can inject malicious SQL queries to extract sensitive database information, hijack administrator sessions, or potentially achieve Remote Code Execution (RCE).

[Mitigation] Immediately upgrade Drupal core to the respective patched versions (10.4.10, 10.5.10, 10.6.9, 11.1.10, 11.2.12, 11.3.10, or later).

[Affected Scope] All supported on-premises Microsoft Exchange Server environments.

[Impact] Unauthenticated remote attackers can execute malicious scripts within the victim's browser session, leading to session hijacking, spoofing, and privilege escalation.

[Mitigation] Apply the official Microsoft security updates immediately, and deploy WAF rules to block anomalous web requests prior to patching.

[Affected Scope] LiteLLM proxy server environments running versions 1.74.2 to before 1.83.7

[Impact] Authenticated users with low-privilege API keys can execute arbitrary OS commands on the proxy host, potentially leading to full system compromise

[Mitigation] Immediately upgrade LiteLLM to the patched version 1.83.7 or later, and restrict access to the vulnerable endpoints in the interim

[Affected Scope] LiteLLM proxy server environments running versions from 1.81.16 to before 1.83.7

[Impact] Unauthenticated attackers can read or modify the proxy's database, leading to unauthorized access to the proxy and managed API credentials

[Mitigation] Immediately upgrade LiteLLM to version 1.83.7 or later, and apply WAF rules to block malicious Authorization headers in the interim

[Affected Scope] cPanel and WHM versions after 11.40 (prior to the April 28, 2026 security update)

[Impact] Unauthenticated remote attackers can bypass the login flow to gain unauthorized administrative access to the control panel, leading to complete server compromise

[Mitigation] Immediately apply the latest security patches provided by the vendor, and restrict external access to management ports (2082, 2083, 2086, 2087) until patched

[Affected Scope] Microsoft SharePoint Server deployments

[Impact] An unauthenticated remote attacker can exploit improper input validation (CWE-20) over the network to perform spoofing, potentially leading to unauthorized data exposure and modification

[Mitigation] Immediately apply the official security updates provided by Microsoft, and implement WAF rules to monitor and block anomalous HTTP requests in the interim

[Affected Scope] Apache Tomcat versions 11.0.20, 10.1.53, and 9.0.116 utilizing clustering with EncryptInterceptor enabled

[Impact] Incomplete fix for CVE-2026-29146 allows attackers to bypass the EncryptInterceptor, leading to the transmission of sensitive session data in plaintext across the network

[Mitigation] Immediately upgrade to patched Apache Tomcat versions 11.0.21, 10.1.54, or 9.0.117

[Affected Scope] Apache Tomcat deployments utilizing EncryptInterceptor with default configurations for cluster membership protection (11.0.0-M1 to 11.0.18, 10.0.0-M1 to 10.1.52, 9.0.13 to 9.0.115, 8.5.38 to 8.5.100, 7.0.100 to 7.0.109).

[Impact] Remote attackers can intercept encrypted cluster traffic and perform a padding oracle attack to decrypt sensitive session data or cluster control messages without knowing the encryption key.

[Mitigation] Upgrade to fixed versions (11.0.19, 10.1.53, or 9.0.116) immediately, or configure the EncryptInterceptor to use secure authenticated encryption (e.g., GCM mode).

[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3

[Impact] An authenticated attacker can execute arbitrary system commands within the broker's JVM by loading a malicious remote Spring XML configuration via the Jolokia JMX-HTTP bridge

[Mitigation] Immediately upgrade Apache ActiveMQ to a patched version (5.19.4 or 6.2.3) and restrict Jolokia access policies

[Affected Scope] Trivy Go/Container image v0.69.4, trivy-action v0.0.1 to v0.34.2 (76 tags), setup-trivy v0.2.0 to v0.2.6

[Impact] A threat actor used compromised credentials to force-push malicious commits to version tags, enabling credential exfiltration from CI/CD pipelines

[Mitigation] Upgrade to safe versions (Trivy v0.69.2/v0.69.3, trivy-action v0.35.0, setup-trivy v0.2.6 recreated) and pin actions to immutable commit SHAs

[Affected Scope] Langflow versions prior to 1.9.0

[Impact] Unauthenticated remote attackers can execute arbitrary Python code and gain full control over the host system

[Mitigation] Immediately upgrade Langflow to version 1.9.0 or higher, and restrict external access to the vulnerable endpoint

[Affected Scope] VMware Aria Operations instances with support-assisted product migration in progress

[Impact] Unauthenticated remote attackers can execute arbitrary OS commands, potentially leading to full system compromise and remote code execution

[Mitigation] Apply official security patches listed in Broadcom VMSA-2026-0001 immediately, or restrict access to migration services

[Affected Scope] Cisco Catalyst SD-WAN Controller (formerly vSmart), Cisco Catalyst SD-WAN Manager (formerly vManage), and Cisco Catalyst SD-WAN Validator (formerly vBond).

[Impact] Unauthenticated remote attackers can bypass peering authentication, gain high-privileged administrative access, and manipulate the entire SD-WAN fabric configuration via NETCONF.

[Mitigation] Apply official Cisco software patches immediately and restrict control plane access to trusted peer IPs using Access Control Lists (ACLs).