12128 matches found
CVE-2026-71040
Oracle Agile PLM 9.3.6's Security component allows an unauthenticated, network-accessible attacker to fully compromise the application (C/I/A impact), yielding complete takeover. CVSS 9.8 Critical. No exploit details provided. Oracle's August 2026 CPU advisory is referenced for patch information.
CVE-2026-71038
...
CVE-2026-71034
Oracle Commerce 11.4.0 (component: Forge) is vulnerable to an unauthenticated SOAP-based attack via network access. Successful exploitation enables an attacker to gain unauthorized access to critical data or complete access to all accessible Oracle Commerce data, with confidentiality impact rated...
CVE-2026-71036
Oracle Commerce version 11.4.0 Experience Manager component is vulnerable to an unauthenticated, network-accessible attack (CVSS 9.1) allowing full confidentiality and integrity compromise. Oracle's August 2026 CPU advisory provides patch details; no exploitation evidence is present in the provid...
CVE-2026-71033
...
CVE-2026-71018
Oracle Commerce 11.4.0's Endeca Application Controller is vulnerable: unauthenticated remote attackers can exploit it via HTTP to read all accessible data and modify some data, requiring victim interaction; CVSS 3.1 score 8.2 (High). No specific root cause or patch details are provided. No known ...
CVE-2026-71015
Oracle Commerce 11.4.0 (Endeca Application Controller) has a critical CVSS 9.1 flaw exploitable by unauthenticated attackers over HTTP, enabling unauthorized data creation, deletion, modification, and full data access; no exploit details are provided, and the Oracle CSP advisory (cspuaug2026.html...
CVE-2026-71014
...
CVE-2026-71008
Oracle Commerce Experience Manager component in version 11.4.0 is affected by a network-reachable vulnerability exploitable by a high-privileged HTTP attacker, enabling unauthorized access to critical or all accessible data (CVSS 6.8, confidentiality impact). Exploitation details are not provided...
CVE-2026-71010
...
CVE-2026-70995
The Endeca Application Controller component in Oracle Commerce 11.4.0 is critically vulnerable (CVSS 9.8) to unauthenticated remote HTTP attacks, enabling full system takeover. Oracle has released patches via its August 2026 Critical Patch Update; organizations should apply them immediately. No p...
CVE-2026-70987
Oracle Commerce 11.4.0's Content Acquisition System component allows unauthenticated remote attackers via HTTP to access critical data (CVSS 7.5 HIGH, confidentiality-only). Oracle has issued updates; see https://www.oracle.com/security-alerts/cspuaug2026.html. Exploitation details are not provid...
CVE-2026-70981
Oracle Commerce 11.4.0 Content Acquisition System is affected by a critical (CVSS 9.1) unauthenticated network-based vulnerability enabling unauthorized data modification and denial of service. No exploitation details are provided; refer to Oracle's August 2026 security alert for patch information.
CVE-2026-70973
...
CVE-2026-70972
...
CVE-2026-70971
Oracle Hyperion Infrastructure Technology 11.2.25.0.000 (Installation and Configuration component) has a network-reachable vulnerability allowing a low-privileged attacker to gain unauthorized access to critical data and modify some data. CVSS 7.1 (HIGH). No exploit details provided; remediation ...
CVE-2026-70965
...
CVE-2026-70960
Oracle Hyperion Financial Management 11.2.25.0.000 has a HIGH-severity (CVSS 7.6) Security component flaw exploitable over HTTP by a low-privileged attacker, enabling unauthorized data access and modification with scope change. Oracle's August 2026 CPU patch is the remediation. No in-the-wild exp...