CVE-2026-46998

The CVE-2026-46998 entry concerns Oracle Enterprise Manager Base Platform (Metadata Plugin) with affected versions 13.5 and 24.1. The vulnerability allows an unauthenticated attacker with network access over HTTPS to compromise the Base Platform, requiring user interaction, and can lead to full t...

CVE-2026-47000

Oracle Enterprise Manager Base Platform (Security Framework) is affected in version 24.1. The CVE-2026-47000 entry indicates an easily exploitable vulnerability that allows a low-privileged, network-accessing attacker (HTTPS) to compromise the Base Platform. Successful attacks can lead to unautho...

CVE-2026-46996

Affected product/component: Oracle Enterprise Manager Base Platform, Metadata Plugin. Vulnerable versions: 13.5 and 24.1. Root cause/impact: exposes an attacker with network access over HTTPS to cause unauthorized creation, deletion, or modification of data, and unauthorized read access; CVSS 3.1...

CVE-2026-46995

CVE-2026-46995 affects Oracle Enterprise Manager Base Platform (component: Metadata Plugin) in versions 13.5 and 24.1. The vulnerability allows a low-privilege, network-accessible attacker over HTTPS to compromise the Base Platform, potentially leading to full takeover (CVSS 3.1 base score 8.8). ...

CVE-2026-46997

CVE-2026-46997 affects Oracle Enterprise Manager Base Platform (Metadata Plugin) with vulnerable versions 13.5 and 24.1. The flaw allows a low-privilege, network-authenticated attacker (via HTTPS) to compromise data integrity, potentially enabling unauthorized creation, deletion, or modification ...

CVE-2026-46994

CVE-2026-46994 affects Oracle Enterprise Manager Base Platform (Oracle Enterprise Manager) - Agent Next Gen component. Affected supported versions are 13.5 and 24.1. The vulnerability allows an unauthenticated attacker with network access over HTTPS to compromise the Base Platform, potentially le...

CVE-2026-46992

The CVE-2026-46992 entry concerns Oracle Enterprise Manager Base Platform, specifically the Enterprise Config Management component. Affected versions are 13.5 and 24.1. The vulnerability is exploitable remotely over HTTPS by a low-privileged attacker, with successful exploitation potentially resu...

CVE-2026-46993

CVE-2026-46993 affects Oracle Enterprise Manager Base Platform (component: Agent Next Gen). Affected versions: 13.5 and 24.1. The vulnerability, exploitable by a low-privileged attacker with network access over HTTPS, can compromise the Base Platform, potentially enabling unauthorized creation, d...

CVE-2026-46989

CVE-2026-46989 affects Oracle Enterprise Manager Base Platform (UI Framework). Affected versions: 13.5 and 24.1. Root cause unspecified beyond the UI Framework component. The vulnerability is exploitable by a low-privilege attacker with network access over HTTPS, with potential to gain unauthoriz...

CVE-2026-46991

The CVE-2026-46991 entry concerns Oracle Enterprise Manager Base Platform (Enterprise Config Management) with affected versions 13.5 and 24.1. The vulnerability allows a low-privilege, locally authenticated attacker to compromise the Base Platform, potentially enabling unauthorized updates/insert...

CVE-2026-46990

CVE-2026-46990 affects Oracle Enterprise Manager Base Platform (Enterprise Config Management) in Oracle Enterprise Manager, with affected versions 13.5 and 24.1. The vulnerability allows an unauthenticated, network-accessible attacker over HTTP to modify or read data and cause a partial DOS, per ...

CVE-2026-46988

The vulnerability affects Oracle Enterprise Manager Base Platform (Connector Framework) with affected versions 13.5 and 24.1. The root cause is not explicitly detailed in the provided documents, but the issue enables a high-privilege attacker who can reach the service over HTTPS to compromise the...

CVE-2026-46987

CVE-2026-46987 affects Oracle Enterprise Manager Base Platform (component: Application Service Level Mgmt). Affected supported versions are 13.5 and 24.1. The vulnerability allows a low-privileged attacker who can reach the system over HTTPS to compromise the Base Platform, with potential scope i...

CVE-2026-46985

CVE-2026-46985 concerns Oracle Enterprise Manager Base Platform, specifically the Agent Next Gen component, with affected versions 13.5 and 24.1. The vulnerability allows an unauthenticated attacker with network access over HTTPS to read a subset of data, per CVSS 3.1 base score 5.3 (Confidential...

CVE-2026-46986

The CVE-2026-46986 entry affects Oracle Enterprise Manager Base Platform (Agent Next Gen). Affected versions include 13.5 and 24.1. The vulnerability allows an unauthenticated attacker with network access over HTTPS to read a subset of data, per CVSS 3.1 base score 5.3 (Confidentiality impact: Lo...

CVE-2026-46984

CVE-2026-46984 affects Oracle Enterprise Manager Base Platform (Agent Next Gen) with impacted versions 13.5 and 24.1. The vulnerability allows an unauthenticated attacker with HTTPS network access to compromise the base platform and obtain read access to a subset of data. The descriptions in the ...

CVE-2026-46981

The CVE-2026-46981 entry affects Oracle Utilities Network Management System (Mobile component) with affected versions 2.5.0.1.0–2.5.0.1.17, 2.5.0.2.0–2.5.0.2.11, 2.6.0.1.0–2.6.0.1.12, 2.6.0.2.0–2.6.0.2.8, and 25.12.0.0.0–25.12.0.0.2. It is an unauthenticated, network-accessible vulnerability expl...

CVE-2026-46983

CVE-2026-46983 affects Oracle Retail Integration Bus (RIB Kernel) in Oracle Retail Applications, with affected version 16.0.3. The vulnerability is exploitable by an unauthenticated attacker with network access via HTTP, potentially enabling takeover of the Oracle Retail Integration Bus. CVSS 3.1...

CVE-2026-46982

VULNERABILITY SUMMARY: CVE-2026-46982 affects Oracle Retail Integration Bus (RIB Kernel) in Oracle Retail Applications, version 14.1.3.2. The issue allows unauthenticated, network-accessible attackers over HTTP to compromise the RIB and potentially take over the system. CVSS v3.1 base score is 9....

CVE-2026-46968

This CVE concerns Oracle Java SE JSSE with affected versions listed (Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18). The vulnerability is exploitable over a network via TLS and ...

CVE-2026-46975

Technical details about CVE-2026-46975 are not publicly available in the provided documents. Monitor the Oracle July 2026 CPU advisory for patched versions and exact vulnerable components.

CVE-2026-46980

CVE-2026-46980 affects Oracle Utilities Network Management System (NMS) Mobile component. Affected versions include 2.5.0.1.0–2.5.0.1.17, 2.5.0.2.0–2.5.0.2.11, 2.6.0.1.0–2.6.0.1.12, 2.6.0.2.0–2.6.0.2.8, and 25.12.0.0.0–25.12.0.0.2. The vulnerability allows a low-privileged attacker with network a...

CVE-2026-46943

Oracle Retail EFTLink (Core/Plugin) is affected in versions 21.0.0–25.0.0. A unauthenticated attacker able to access over HTTPS can compromise EFTLink, enabling unauthorized creation, deletion, or modification of data, and broader data access. The CVSS v3.1 base score is 7.4 (Confidentiality and ...

CVE-2026-46948

CVE-2026-46948 affects Oracle Utilities Network Management System (Oracle Utilities Applications), specifically the Security component, with affected versions: 2.4.0.1.0-2.4.0.1.32, 2.5.0.1.0-2.5.0.1.17, 2.5.0.2.0-2.5.0.2.11, 2.6.0.2.0-2.6.0.2.7 and 25.12.0.0.0. The vulnerability is exploitable r...

CVE-2026-46954

CVE-2026-46954 affects Oracle E-Business Suite Human Resources, Data Removal Tool (versions 12.2.3–12.2.15). The vulnerability allows a high-privilege attacker with network access via HTTP to take over Oracle HR; CVSSv3.1 base score 7.2 (C/H/I/A). The provided documents do not describe the exact ...

CVE-2026-46936

CVE-2026-46936 affects Oracle MySQL Server (component: Server: DDL) and MySQL Cluster. Affected versions include MySQL Server 8.4.0–8.4.10, 9.7.0–9.7.1 and MySQL Cluster 8.0.0–8.0.47, 8.4.0–8.4.10, 9.7.0–9.7.1. The vulnerability is described as difficult to exploit and requires network access via...

CVE-2026-46941

Oracle E-Business Suite Cost Management's Cost Maintenance component is affected (CVE-2026-46941) in versions 12.2.3–12.2.15. A low-privilege attacker with network access via HTTP can compromise Oracle Cost Management, potentially taking full control (CVSS 7.5). The vulnerability details, impact ...

CVE-2026-46924

CVE-2026-46924 affects Oracle Application Testing Suite (ATS) 13.3.0.1. The vulnerability allows an unauthenticated attacker with network access via TCP to compromise ATS, enabling takeover with high impact on confidentiality, integrity, and availability. The CVSS 3.1 base score is 9.8 (CRITICAL)...

CVE-2026-46923

CVE-2026-46923 affects Oracle E-Business Suite Public Sector Financials (International) — Authorization component. Affected versions are 12.2.3 through 12.2.15. The issue can be triggered by a high-privileged attacker with network access via HTTP, potentially leading to takeover of Oracle Public ...

CVE-2026-46917

The CVE-2026-46917 entry affects Oracle Java SE (components including JSSE) and Oracle GraalVM for JDK/Enterprise Edition. Affected Oracle Java SE versions: 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19, 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. The vulnera...

CVE-2026-46876

CVE-2026-46876 affects Oracle Application Testing Suite, specifically version 13.3.0.1. The vulnerability is described as easily exploitable with unauthenticated network access via Oracle Net, allowing takeover of Oracle Application Testing Suite and carrying a CVSS v3.1 base score of 9.8 (C/H/I/...

CVE-2026-35290

CVE-2026-35290 affects Oracle Application Testing Suite, version 13.3.0.1. The vulnerability allows an unauthenticated attacker with network access via TCP to compromise the suite, with potential takeover and a CVSS v3.1 base score of 9.8 (C­: H, I: H, A: H). Connected sources confirm the same af...

CVE-2026-35287

Affected product: Oracle Application Testing Suite 13.3.0.1. Description shows an unauthenticated, network-accessible vulnerability via TCP that can lead to unauthorized data access. CVSS v3.1 base score 7.5 (ConfidentialityImpact H). No concrete root cause, vulnerable component, or remediation d...

CVE-2026-34316

Oracle Core: CVE-2026-34316 affects Oracle Commerce Service Center (component: Commerce Service Center) in Oracle Commerce 11.4.0. The vulnerability is exploitable over HTTP with network access by an unauthenticated attacker and requires user interaction. Impact includes unauthorized update/inser...

CVE-2026-21954

CVE-2026-21954 affects Oracle Retail Xstore Point of Service (Xstore Mobile), affected in version 21.0.3. A low-privileged, network-access attacker (via HTTP) can cause unauthorized read access to a subset of Xstore POS data. CVSSv3.1 base score 4.3 (Confidentiality). The Oracle July 2026 Critica...

CVE-2026-21953

Oracle Retail Xstore Point of Service (Xstore Mobile) vulnerability CVE-2026-21953 affects version 21.0.3; a low-privilege, locally authenticated attacker can read a subset of Xstore Mobile data. The CVSS v3.1 base score is 3.3 (Confidentiality impact). No exploitation details are provided in the...

CVE-2026-56745

Netty CVE-2026-56745 affects the SPDY-to-HTTP codec SpdyHttpDecoder. In vulnerable versions (4.2.0.Final–4.2.15.Final and 4.1.0.Final–4.1.135.Final), processing a client SYN_STREAM with FLAG_FIN=0 can cause the decoder to pool a ByteBuf and cache a partially built FullHttpRequest in messageMap. W...

CVE-2026-47709

libheif (HEIF/AVIF decoder/encoder) has a null pointer dereference in heif_image_handle_get_image_tiling for malformed uncompressed image items with uncC but no ispe. In debug builds this triggers an ispe && uncC assertion; in release/ASan builds it can cause a null read at address 0xa8. Affected...

CVE-2026-65317

Verba RAG application 2.1.3 is affected by a server-side request forgery (SSRF) vulnerability combined with a same-origin middleware bypass. An unauthenticated attacker can issue arbitrary outbound HTTP requests by supplying a crafted Origin header and attacker-controlled host/port values to the ...

CVE-2026-10680

CVE-2026-10680 affects Zephyr Project’s Classic BR/EDR L2CAP signaling: l2cap_br_conf_req() and l2cap_br_conf_rsp() validate the per-command length against the whole PDU length (buf->len) instead of the per-command len, allowing underflow of opt_len and an out-of-bounds read/write during confi...

CVE-2026-10679

The CVE-2026-10679 issue affects Zephyr’s DesignWare SPI driver (drivers/spi/spi_dw.c). The root cause is that the BAUDR clock divider was computed as info->clock_frequency / config->frequency without validating frequency, allowing a userspace thread with SPI access to pass frequency = 0, t...

CVE-2026-10678

The CVE-2026-10678 issue affects Zephyr’s MCTP over I2C+GPIO target binding (mctp_i2c_gpio_target.c). It processes I2C bus master writes byte-by-byte without validating the receive buffer, dereferencing b->rx_pkt to write data for data registers (MCTP_I2C_GPIO_RX_MSG_ADDR) before the receive b...

CVE-2026-10675

Zephyr Project Bluetooth Mesh PB-ADV vulnerability (CVE-2026-10675) in prov_msg_recv() reschedules the provisioning watchdog timer unconditionally at the top of the function, before FCS and ADV_LINK_INVALID checks. If a provisioning attempt fails (ADV_LINK_INVALID set), a malicious, unauthenticat...

CVE-2026-10677

The CVE concerns Zephyr’s CONFIG_USERSPACE verifier z_vrfy_k_poll() in kernel/poll.c, where a user-supplied k_poll_event[] is copied to kernel space and validated. Previously, an inline K_OOPS(K_SYSCALL_OBJ(...)) inside the loop could leak the allocation when a forged object handle was encountere...

CVE-2026-10674

The CVE describes a Denial of Service risk in the NXP LPUART driver for Zephyr (drivers/serial/uart_mcux_lpuart.c). When CONFIG_UART_USE_RUNTIME_CONFIGURE is enabled, LPUART_Deinit() is called at the start of mcux_lpuart_configure(), which disables peripheral clocks. Validation of the requested c...

CVE-2026-16484

SourceCodester Class and Exam Timetabling System 1.0 is affected by a SQL injection in the /edit_subjecta.php parameter ID. The vulnerability arises from manipulating the ID argument, enabling remote exploitation. The exploit has been published and may be used. CVSS metrics in the entry indicate ...

CVE-2026-43946

FUXA (web-based Process Visualization) version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint, allowing unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue. The vulnerability enables an unauthenticated user to retriev...

CVE-2026-43945

Summary: FUXA versions 1.2.11–1.3.1 are vulnerable to pre-auth RCE via path manipulation in the authentication middleware. An unauthenticated remote attacker can achieve root-level RCE by crafting requests that bypass authentication on Node-RED administrative endpoints through a faulty URL check ...

CVE-2026-8989

Autel Maxi Charger Single firmware (V1.03.51) is affected. The issue allows unrestricted access to the NXP i.MX6 recovery mode via exposed hardware recovery pins. With physical access, an attacker can boot attacker‑controlled code in memory and modify or extract firmware and other sensitive data....

CVE-2026-65316

XXL-Job version 2.4.2 is affected by an insecure direct object reference in the logDetailCat endpoint, enabling authenticated users to read execution logs from job groups they’re not authorized to access by supplying arbitrary sequential logId values. This allows cross-group disclosure of potenti...