CVE Vulnerability Advisory Database

[Affected Scope] TrueConf Server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier

[Impact] Remote unauthorized attackers can execute arbitrary scripts and compromise the server by calling undocumented functions via TCP port 4307 without authentication

[Mitigation] Immediately upgrade TrueConf Server to the latest secure version and restrict external network access to TCP port 4307

[Affected Scope] Microsoft Office SharePoint Server environments

[Impact] Unauthenticated remote attackers can bypass authentication mechanisms over the network to elevate privileges to administrative levels

[Mitigation] Immediately apply the official Microsoft security patches and restrict external network access to SharePoint management endpoints

[Affected Scope] LiteLLM proxy server and AI Gateway environments running versions prior to 1.84.0

[Impact] Unauthenticated attackers can bypass API key validation using a fabricated Authorization header, gaining unauthorized access to internal MCP tools and LLM APIs.

[Mitigation] Immediately upgrade the LiteLLM package to version 1.84.0 or higher.

[Affected Scope] Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62

[Impact] Unauthenticated remote attackers can compromise and completely take over the PeopleSoft Enterprise PeopleTools system via HTTP network access

[Mitigation] Immediately apply the official Oracle Critical Patch Update (CPU) and restrict external HTTP access to the affected component

[Affected Scope] Splunk Enterprise versions 10.2.x below 10.2.4 and 10.0.x below 10.0.7 (versions 9.4 and earlier are unaffected)

[Impact] An unauthenticated remote attacker can access the PostgreSQL sidecar service endpoint to create or truncate arbitrary files, potentially leading to Remote Code Execution (RCE)

[Mitigation] Immediately upgrade to patched versions (10.2.4+, 10.0.7+) or disable the PostgreSQL sidecar service if an immediate upgrade is not feasible

[Affected Scope] Oracle E-Business Suite (EBS) versions 12.2.3 through 12.2.15, specifically the Oracle Payments (File Transmission) component

[Impact] Unauthenticated remote attackers can bypass authentication via HTTP, leading to complete takeover of the Oracle Payments module

[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, and restrict external HTTP access to the Payments module until patched

[Affected Scope] cPanel and WHM versions after 11.40 (prior to the April 28, 2026 security update)

[Impact] Unauthenticated remote attackers can bypass the login flow to gain unauthorized administrative access to the control panel, leading to complete server compromise

[Mitigation] Immediately apply the latest security patches provided by the vendor, and restrict external access to management ports (2082, 2083, 2086, 2087) until patched

[Affected Scope] All versions of marimo open-source Python notebook prior to 0.23.0

[Impact] Unauthenticated remote attackers can establish a connection to the `/terminal/ws` endpoint, obtaining a full PTY shell and executing arbitrary system commands

[Mitigation] Immediately upgrade the marimo package to version 0.23.0 or higher

[Affected Scope] Langflow versions prior to 1.3.0

[Impact] A remote, unauthenticated attacker can execute arbitrary Python code and fully compromise the host system by sending crafted HTTP requests.

[Mitigation] Immediately upgrade Langflow to version 1.3.0 or later, and restrict external access to the vulnerable endpoint.