CVE-2026-73879

Oracle Helidon 4.5.1's Imperative Web Server component is affected by a HIGH severity (CVSS 7.5) unauthenticated, network-reachable integrity vulnerability. No root cause, exploit details, or patch version are provided; monitor Oracle's CSP August 2026 advisory for remediation guidance.

CVE-2026-73876

...

CVE-2026-73866

Oracle Helidon 4.5.0's Imperative Web Server component contains a critical vulnerability (CVSS 9.1) exploitable by an unauthenticated network attacker via HTTP, granting unauthorized creation, deletion, and modification of all Helidon-accessible data. No patch version, exploit details, or in-the-...

CVE-2026-71101

CVE-2026-71101 affects the US Payroll Tax Issues component of Oracle HRMS (US) within Oracle E-Business Suite , versions 12.2.3 through 12.2.15 . A low-privileged attacker with local logon to the infrastructure where the product executes can exploit this vulnerability to achieve full takeover of ...

CVE-2026-71065

CVE-2026-71065 is a critical vulnerability (CVSS 3.1: 9.3) in Oracle Helidon (component: Imperative Web Server), affecting version 3.2.18 . An unauthenticated attacker with network access via HTTP can exploit it to gain unauthorized access to critical data and perform unauthorized update, insert,...

CVE-2026-71063

...

CVE-2026-71057

A HIGH-severity (CVSS 8.5) HTTP-accessible vulnerability in Oracle BI Publisher's BI Platform Security component affects versions 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0, allowing a low-privileged attacker to access critical data and cause partial denial of service. Oracle's August 2026 security ad...

CVE-2026-71031

...

CVE-2026-71031

Oracle Commerce 11.4.0's Endeca Application Controller component is vulnerable via HTTP to an unauthenticated, easily exploitable attack requiring user interaction (CVSS 6.1). Successful attacks enable unauthorized read, update, insert, and delete access to affected data with scope change to addi...

CVE-2026-71029

Oracle Helidon 3.2.18 Imperative Web Server component is affected by a CVSS 6.8 medium-severity vulnerability allowing unauthenticated remote attackers to compromise Helidon and access critical data, with potential scope change impacting additional products. No patch or exploit details are provid...

CVE-2026-71017

Oracle Commerce 11.4.0's Endeca Application Controller is vulnerable to an unauthenticated, network-accessible HTTP attack (CVSS 6.5, HIGH complexity). Successful exploitation yields unauthorized access to critical data and partial denial of service. No exploit details are provided; Oracle's Augu...

CVE-2026-71011

CVE-2026-71011 affects the Experience Manager component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager , version 11.4.0 . An unauthenticated attacker with network access via HTTP can exploit this vulnerability, though successful exploitation requires user interaction from a...

CVE-2026-71010

Oracle Commerce version 11.4.0's Experience Manager component is vulnerable to a HIGH-severity (CVSS 7.8) local exploit requiring infrastructure access and human interaction, enabling unauthenticated attackers to compromise the application with full CIA impact. Oracle has released patches in its ...

CVE-2026-70995

...

CVE-2026-70981

...

CVE-2026-70976

CVE-2026-70976 affects the Content Acquisition System component of Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 . An unauthenticated attacker with network access via HTTP can exploit this vulnerability with low complexity and no user interaction to achieve una...

CVE-2026-70970

CVE-2026-70970 affects the Runtime Tools component of Oracle WebCenter Portal (versions 12.2.1.4.0 and 14.1.2.0.0). An unauthenticated attacker with network HTTP access can compromise the application; CVSS 9.8 (critical) reflects full confidentiality, integrity, and availability impact. Oracle's ...

CVE-2026-70964

Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 has a HIGH-severity (CVSS 8.2) vulnerability in the Installation and Configuration component, allowing a low-privileged network attacker to compromise the system with unauthorized data access, creation, deletion, or modification acro...

CVE-2026-70957

Oracle Hyperion Infrastructure Technology (component: Installation and Configuration) at version 11.2.25.0.000 has a HIGH-severity (CVSS 8.1) flaw: a low-privileged network attacker via HTTP can gain unauthorized read/write access to critical application data. No exploit or patch details are prov...

CVE-2026-70948

Oracle E-Business Suite Purchasing (versions 12.2.3–12.2.15) has a HIGH-severity flaw allowing a low-privileged attacker with network access to fully compromise the application; apply Oracle's August 2026 CPU patches immediately. No exploitation details are provided in the documents.