VulnerabilitiesExploitedCVE-2026-18577CVSS 8.24 min read
The vendor shut its hosted environments on November 9 and told on-premises customers to do the same, while it works on a hotfix. It says it hasn't seen exploitation in the wild.
VulnerabilitiesExploitedCVE-2026-46817CVSS 9.82 min read
Defused says its decoys logged exploratory exploitation attempts against a critical SQL injection flaw in Oracle E-Business Suite's Application Object Library, patched in Oracle's October CPU.
VulnerabilitiesExploitedCVE-2026-35273CVSS 9.82 min read
Researchers say the PeopleSoft bug ShinyHunters has exploited since May is a chain of three flaws, all patched under one CVE identifier in June. The root is an SSRF that reaches an internal management interface.
VulnerabilitiesBrief2 min read
The bugs can let revoked client certificates through, expose some encrypted sessions to eavesdroppers, or bypass a certificate chain length cap, but each affects only a subset of deployments.
VulnerabilitiesCVE-2026-91403CVSS 9.12 min read
Tenable's count puts 1,209 unique CVEs in the quarterly update, 95 of them critical. A separate Java advisory followed a day later.
