CVE-2026-70933: Improper Access Control

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial...

CVE-2026-71041: Improper Access Control

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain component: Gantt Chart. The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile PLM executes to compromise Oracle Agi...

CVE-2026-70805: Missing Authentication for Critical Function

Vulnerability in the Oracle Project Planning and Control product of Oracle E-Business Suite component: Change Management. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-61033: Improper Access Control

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware component: WebCenter Sites. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-12631: Missing Authorization

The Zephyr kernel validates the kthreadjoin and kthreadabort system calls declared syscall in include/zephyr/kernel.h through threadobjvalidate in kernel/thread.c. Its default switch branch is the access-denied path, taken when kobjectvalidate returns -EPERM the calling user thread was never...

CVE-2026-70810: Improper Access Control

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Scripting. Successfu...

CVE-2026-73900: Improper Access Control

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. Supported versions that are affected are 4.0.0-4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this...

PT-2026-77895

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Data Relationship Management version 11.2.25.0.000 Description An issue exists in the Access and security component that allows a low privileged attacker with access to the infrastructure where the software executes to compromi...

CVE-2026-73872: Improper Access Control

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. Supported versions that are affected are 4.0.0-4.4.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this...

CVE-2026-70681: Improper Access Control

Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite component: JRI and other Java utils. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-70678: Improper Access Control

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion component: Security. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Calculation...

CVE-2026-60830: Improper Access Control

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite component: Worklist. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Workflow. Successful attacks of...

CVE-2026-61212: Improper Access Control

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Runtime Tools. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-60866: Improper Access Control

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware component: Messaging Enabler. The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Service Delivery...

CVE-2026-70951: Improper Access Control

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM component: Document Management. Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM End User. Successful...

CVE-2026-71012: Improper Access Control

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce component: Experience Manager. The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to...

CVE-2026-70871: Improper Access Control

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion component: Access and security. The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle...

CVE-2026-73925: Improper Access Control

Vulnerability in the Helidon product of Oracle Fusion Middleware component: Imperative Web Server. Supported versions that are affected are 1.0.0-1.4.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this...

CVE-2026-66651: Missing Authorization

Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...

CVE-2026-67920: External Control of File Name or Path

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir, and org.springframework.util.FileSystemUtils.copyRecursively components...