CVE-2026-71119

Oracle HFM Security component in version 11.2.25.0.000 is affected by a local vulnerability exploitable only by a high-privileged attacker with infrastructure access, potentially resulting in full application takeover (CVSS 6.4). No exploit details are provided; Oracle's August 2026 security advi...

CVE-2026-71116

Oracle VM VirtualBox 7.2.14 Core component has a HIGH-severity local vulnerability (CVSS 7.5) exploitable by a high-privilege attacker logged into the host, potentially compromising the hypervisor and additional products (scope change). No fix version is specified in the provided documents. Monit...

CVE-2026-71117

Oracle Hyperion Financial Management version 11.2.25.0.000 contains a Security-component flaw (CVSS 7.5, HIGH) exploitable by a high-privileged local attacker to fully compromise the application and potentially other products. Oracle's August 2026 CPU advisory is the remediation reference. No exp...

CVE-2026-71111

The Installer component of Oracle Identity Manager (versions 12.2.1.4.0 and 14.1.2.1.0) is vulnerable to a local privilege escalation (CVSS 7.8, HIGH) allowing a low-privileged attacker with host access to take over the product. No exploitation details are provided; apply the Oracle August 2026 C...

CVE-2026-71109

Oracle Hyperion Financial Management 11.2.25.0.000 Security component has an easily exploitable local vulnerability allowing high-privileged attackers with infrastructure access to fully compromise the product (CVSS 6.7). No exploitation details are provided. Patch status is not specified in the ...

CVE-2026-71106

Oracle Hospitality OPERA 5 Property Services (component: Opera Servlet ) is affected by a vulnerability in versions 5.6.28.0–5.6.28.1 . An unauthenticated attacker with network access via HTTP can achieve full system takeover (complete compromise of confidentiality, integrity, and availability). ...

CVE-2026-71104

...

CVE-2026-71089

Oracle Agile PLM MCAD Connector CAX Client version 3.6 is vulnerable: an unauthenticated attacker with local infrastructure access can exploit it (low complexity, human interaction required) to gain unauthorized read access to a subset of accessible data. CVSS 3.3 LOW; no exploitation observed. O...

CVE-2026-71079

...

CVE-2026-71078

Oracle Agile PLM MCAD Connector (component: CAX Client, version 3.6) has a local privilege escalation vulnerability requiring low privileges, high attack complexity, and human interaction. Successful exploitation yields unauthorized read/write/delete access to a subset of data and partial DoS. CV...

CVE-2026-71076

...

CVE-2026-71064

...

CVE-2026-71043

Oracle Agile PLM 9.3.6 (Security component) has an unauthenticated, network-reachable flaw exploitable via HTTP. CVSS 3.1 scores it HIGH (7.5, C:H), allowing unauthorized access to critical or all accessible data. No exploitation or patch details are provided; see Oracle's August 2026 CPU advisor...

CVE-2026-71040

Oracle Agile PLM 9.3.6's Security component allows an unauthenticated, network-accessible attacker to fully compromise the application (C/I/A impact), yielding complete takeover. CVSS 9.8 Critical. No exploit details provided. Oracle's August 2026 CPU advisory is referenced for patch information.

CVE-2026-71038

...

CVE-2026-71034

Oracle Commerce 11.4.0 (component: Forge) is vulnerable to an unauthenticated SOAP-based attack via network access. Successful exploitation enables an attacker to gain unauthorized access to critical data or complete access to all accessible Oracle Commerce data, with confidentiality impact rated...

CVE-2026-71036

Oracle Commerce version 11.4.0 Experience Manager component is vulnerable to an unauthenticated, network-accessible attack (CVSS 9.1) allowing full confidentiality and integrity compromise. Oracle's August 2026 CPU advisory provides patch details; no exploitation evidence is present in the provid...

CVE-2026-71033

...

CVE-2026-71018

Oracle Commerce 11.4.0's Endeca Application Controller is vulnerable: unauthenticated remote attackers can exploit it via HTTP to read all accessible data and modify some data, requiring victim interaction; CVSS 3.1 score 8.2 (High). No specific root cause or patch details are provided. No known ...

CVE-2026-71015

Oracle Commerce 11.4.0 (Endeca Application Controller) has a critical CVSS 9.1 flaw exploitable by unauthenticated attackers over HTTP, enabling unauthorized data creation, deletion, modification, and full data access; no exploit details are provided, and the Oracle CSP advisory (cspuaug2026.html...