CVE-2026-83206

Vulnerability in the Oracle Banking Corporate Lending Process Management product of Oracle Financial Services Applications component: Base. Supported versions that are affected are 14.5.0.0.0-14.9.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTT...

CVE-2026-83170

Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite component: Documents. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with access to the physical communication segment attached to the...

CVE-2026-83033

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCent...

CVE-2026-87256

Oracle Agile PLM version 9.3.6 (component: Application Server) is affected by an easily exploitable vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the product. Due to scope change , attacks may significantly impact additional products beyond Agile P...

EUVD-2026-79893

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial...

CVE-2026-87224

Oracle Hyperion Financial Management (component: Security ) in supported version 11.2.26.0.000 is affected by an easily exploitable vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the product. Successful exploitation results in a full takeover of Ora...

EUVD-2026-79760

Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite component: MWA Terminal Server. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Mobil...

CVE-2026-83415

Oracle Coherence (Core component) of Oracle Fusion Middleware is affected by a vulnerability in supported versions 12.2.1.4.0 , 14.1.1.0.0 , 14.1.2.0.0 , and 15.1.1.0.0 . The vulnerability allows a low-privileged attacker with network access via HTTP to fully compromise the product, resulting in ...

CVE-2026-83328

CVE-2026-83328 affects the Personalization component of Oracle Applications Framework within Oracle E-Business Suite, versions 12.2.3 through 12.2.15 . An easily exploitable vulnerability allows a high-privileged attacker with network access via HTTP to compromise the framework, resulting in a fu...

EUVD-2026-79670

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: Administration. Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI...

CVE-2026-83306

Oracle JDeveloper (Oracle Fusion Middleware), specifically the Resource Catalog Services component, is affected in supported versions 12.2.1.4.0 and 14.1.2.0.0 . A low-privileged attacker with network access via HTTP can exploit this vulnerability to achieve full takeover of the Oracle JDeveloper...

EUVD-2026-79648

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: BI Search. Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to...

EUVD-2026-79636

Vulnerability in the Oracle BI Publisher product of Oracle Analytics component: BI Platform Security. Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via SOAP to compromise Oracle ...

EUVD-2026-79561

Vulnerability in the Siebel CRM Development product of Oracle Siebel CRM component: Workflow. Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Development. Successful attacks o...

EUVD-2026-79333

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware component: Client Bundle. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise...

EUVD-2026-79316

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle...

CVE-2026-73949

A vulnerability in the Portlet Services component of Oracle WebCenter Portal (part of Oracle Fusion Middleware) affects supported versions 12.2.1.4.0 and 14.1.2.0.0 . A low-privileged attacker with network access via HTTP can exploit this vulnerability without user interaction to achieve full tak...

CVE-2026-59160

@yeger/turbo-graph (an npm package in the Yeger monorepo) prior to version 2.8.9 exposes an embedded Next.js server on all network interfaces (0.0.0.0:29312 by default) due to a missing hostname argument in .listen() at packages/turbo-graph/src/index.ts:44. The /api/run GET handler (packages/turb...

Windows Server Update Service - Insecure Deserialization

Windows Server Update Service contains an insecure deserialization vulnerability caused by deserialization of untrusted data. An unauthorized attacker with network access can exploit this to execute arbitrary code remotely, potentially leading to full system compromise. id: CVE-2025-59287 info:...

CVE-2026-59160: Missing Authentication for Critical Function

Yeger is a monorepo for npm packages maintained under the yeger scope. Prior to 2.8.9, the turbo-graph package starts its embedded Next.js server from packages/turbo-graph/src/index.ts on all interfaces, including 0.0.0.0:29312 by default, while the GET handler for /api/run in...