CVE-2026-70995

The Endeca Application Controller component in Oracle Commerce 11.4.0 is critically vulnerable (CVSS 9.8) to unauthenticated remote HTTP attacks, enabling full system takeover. Oracle has released patches via its August 2026 Critical Patch Update; organizations should apply them immediately. No p...

CVE-2026-70972

...

CVE-2026-70971

...

CVE-2026-70970

CVE-2026-70970 affects the Runtime Tools component of Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0). An unauthenticated attacker with network HTTP access can compromise the application; CVSS 9.8 (critical) reflects full confidentiality, integrity, and availability impact. Oracle's ...

CVE-2026-70965

...

CVE-2026-70959

...

CVE-2026-70959

...

CVE-2026-70949

...

CVE-2026-70944

...

CVE-2026-70936

...

CVE-2026-70936

...

CVE-2026-70938

...

CVE-2026-70935

Oracle Hyperion Financial Management 11.2.25.0.000 has a Security-component flaw: a low-privileged attacker with network HTTP access can read all accessible data (HIGH confidentiality) and cause partial DoS (LOW availability), CVSS 7.1. No patch version or exploit details are provided; see Oracle...

CVE-2026-70901

...

CVE-2026-70899

...

CVE-2026-70896

...

CVE-2026-70897

...

CVE-2026-70890

Oracle Hyperion DRM 11.2.25.0.000 has an unauthenticated, easily exploitable HTTP access-and-security flaw (CVSS 7.5) allowing full confidentiality compromise; Oracle's August 2026 CPU advisory is referenced, but no patch or exploit details are provided in the documents.

CVE-2026-70873

...

CVE-2026-70872

Oracle Hyperion Data Relationship Management (component: Access and security), version 11.2.25.0.000, is affected by an unauthenticated, network-reachable flaw (CVSS 9.1) enabling full confidentiality and integrity compromise of accessible data; no public exploit details are available. Patch guid...