CVE-2026-60576

The CVE-2026-60576 entry describes a vulnerability in Oracle E-Business Suite's Oracle Enterprise Command Center Framework (component: Core), affected in version V16. An attacker with high privileges can exploit it over HTTP with network access to potentially take over the Oracle Enterprise Comma...

CVE-2026-60339

The CVE-2026-60339 entry concerns Oracle E-Business Suite, specifically the Oracle Project Manufacturing (PJM Command Center) component. Affected product: Oracle E-Business Suite PJM Command Center in version V16. Root cause details are not explicitly stated beyond the vulnerability permitting a ...

CVE-2026-60340

The CVE-2026-60340 entry applies to Oracle E-Business Suite, specifically the Oracle Project Costing component (Enterprise Command Center). Affected versions are 12.2.3–12.2.15. The vulnerability, described across NVD/Oracle sources, permits a high-privilege attacker with network access over HTTP...

CVE-2026-60336

The CVE concerns Oracle E-Business Suite’s Oracle Project Manufacturing (PJM Command Center) on V16. It enables a highly privileged local attacker to compromise PJM, potentially creating/deleting/modifying critical data and gaining access to all PJM data. The CVSS v3.1 base score is 5.7 (Confiden...

CVE-2026-60337

Technical details about CVE-2026-60337 are not publicly provided in the supplied documents. Monitor Oracle CPU July 2026 advisory and NVD entries for updates on affected versions, impact, and remediation.

CVE-2026-60338

The CVE-2026-60338 entry concerns Oracle E-Business Suite’s Oracle Project Manufacturing with the PJM Command Center component (affected: V16). The vulnerability description indicates a low-privilege attacker who can log on to the infrastructure where Oracle Project Manufacturing runs could poten...

CVE-2026-60321

CVE-2026-60321 affects Oracle E-Business Suite Oracle Project Manufacturing (PJM Command Center) in version V16. The vulnerability allows a high-privilege user with local logon to compromise PJM, potentially leading to unauthorized creation/modification/deletion of data or access to all PJM data....

CVE-2026-60165

CVE-2026-60165 is a vulnerability in Oracle Cost Management within Oracle E-Business Suite (component: Enterprise Command Center). Affected product/version is EBS V16. The issue allows a high-privilege attacker with network access over HTTP to compromise Oracle Cost Management, enabling unauthori...

EUVD-2026-46397

The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability...

EUVD-2026-46418

A vulnerability in the command line interface of ECOS devices could allow a highly privileged, authenticated remote attacker to perform command injection on certain CLI commands. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

EUVD-2026-46388

Unvalidated input in asset filter parameters allows shell metacharacters to escape command argument handling, resulting in remote code execution as a low-privileged OS user via the Analysis REST endpoint...

EUVD-2026-46391

A filename supplied during file upload is not properly sanitized before being used in system command execution, allowing an attacker to inject shell metacharacters and achieve command injection via the audit file upload functionality...

EUVD-2026-46356

Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow a remote high-privileged user to execute arbitrary code as a privileged user on the underlying operating system...

EUVD-2026-46357

An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to copy arbitrary files to a user readable location from the command line interface of the underlying operating system, which could lead to remote code execution...

CVE-2026-10680 Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow

The Classic BR/EDR L2CAP signaling handlers l2capbrconfreq and l2capbrconfrsp in subsys/bluetooth/host/classic/l2capbr.c validated the minimum command size against buf-len the bytes remaining in the whole received PDU instead of len the per-command data length from the L2CAP signaling header...

EUVD-2026-46449

The Classic BR/EDR L2CAP signaling handlers l2capbrconfreq and l2capbrconfrsp in subsys/bluetooth/host/classic/l2capbr.c validated the minimum command size against buf-len the bytes remaining in the whole received PDU instead of len the per-command data length from the L2CAP signaling header...

CVE-2026-10680

CVE-2026-10680 affects Zephyr Project’s Classic BR/EDR L2CAP signaling: l2cap_br_conf_req() and l2cap_br_conf_rsp() validate the per-command length against the whole PDU length (buf->len) instead of the per-command len, allowing underflow of opt_len and an out-of-bounds read/write during confi...

CVE-2026-10680 Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow

The Classic BR/EDR L2CAP signaling handlers l2capbrconfreq and l2capbrconfrsp in subsys/bluetooth/host/classic/l2capbr.c validated the minimum command size against buf-len the bytes remaining in the whole received PDU instead of len the per-command data length from the L2CAP signaling header...

CVE-2026-10680 Out-of-bounds access in Zephyr BR/EDR L2CAP configuration request handling via `uint16_t` length underflow

The Classic BR/EDR L2CAP signaling handlers l2capbrconfreq and l2capbrconfrsp in subsys/bluetooth/host/classic/l2capbr.c validated the minimum command size against buf-len the bytes remaining in the whole received PDU instead of len the per-command data length from the L2CAP signaling header...

CVE-2026-8987 Authenticated Heap Overflow

Autel Maxi Charger Single firmware through V1.03.51 contains a heap-based buffer overflow in the setapparam command handled by the /localcfg endpoint. An authenticated attacker can supply oversized input, resulting in denial of service and potentially arbitrary code execution...