CVE-2026-73948: Improper Access Control

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Composer. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter...

CVE-2026-73947: Improper Authentication

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-73946: Improper Access Control

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-73945: Improper Access Control

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-73944: Improper Authentication

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-73943: Improper Access Control

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware component: OIM Legacy UI. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Identit...

CVE-2026-73926: Improper Access Control

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle...

CVE-2026-71133: Improper Authentication

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware component: Authentication Engine. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle...

CVE-2026-83424: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware component: Oracle JDeveloper. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle JDevelope...

CVE-2026-83354: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. The supported version that is affected is 15.1.1.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Coherence. While the vulnerability i...

CVE-2026-69214: Session Fixation

Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Domain attribute without checking that it domain-matches the host that supplied the cookie or rejecting public suffixes. A malicious or compromised server...

CVE-2026-91997: Incorrect Comparison

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version,...

PT-2026-92378

The DigestAuth server middleware's stale-nonce cleanup uses an inverted comparison: it removes fresh nonces and stops at the first stale one. Because a new nonce is created for every unauthenticated challenge, an attacker can drive the nonce map to grow without bound until the JVM runs out of hea...

PT-2026-92426

The CookieJar client middleware decides whether to attach a cookie to an outgoing request using an unanchored substring test on the host and path, instead of the domain match specified by RFC6265 5.1.3. A cookie stored for example.com is therefore sent to any host whose name merely contains...

PT-2026-93109

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon versions 4.0.0 through 4.5.4 Description A flaw in the helidon-webserver-static-content component allows an unauthenticated attacker with network access via HTTP to compromise the system. This can lead to a han...

PT-2026-92943

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon versions 4.0.0 through 4.5.4 Description A flaw in the helidon-microprofile-security component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to unauthoriz...

PT-2026-92926

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon versions 3.0.0 through 3.2.20 Description A flaw in the helidon-media-multipart component allows an unauthenticated attacker with network access via HTTP to compromise the system. This can result in a partial...

PT-2026-92927

Name of the Vulnerable Software and Affected Versions Oracle Fusion Middleware Helidon versions 4.0.0 through 4.5.4 Description A flaw in the LRA component allows an unauthenticated attacker with network access via HTTP to compromise the system. This can lead to unauthorized read access to a subs...

PT-2026-92935

Vulnerability in the Helidon product of Oracle Fusion Middleware component: WebSocket. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerabilit...

PT-2026-92925

Vulnerability in the Helidon product of Oracle Fusion Middleware component: JSON. Supported versions that are affected are 4.0.0-4.5.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can...