Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Applications Framework. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Framework accessible data as well as unauthorized update, insert or delete access to some of Oracle Applications Framework accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N).
A high-severity vulnerability (CVE-2026-83335) exists in Oracle Business Intelligence Enterprise Edition (component: Analytics Server) versions 8.2.0.0.0 and 26.01.0.0.0. This vulnerability allows a low-privileged attacker with network access via HTTP to potentially take over the affected product. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released a Critical Security Patch Update in September 2026 addressing this and many other vulnerabilities across multiple products.
Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected are 8.2.0.0.0, 12.2.1.4.0 and 26.01.0.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle BI Publisher. While the vulnerability is in Oracle BI Publisher, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle BI Publisher accessible data. CVSS 3.1 Base Score 7.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N).
A vulnerability exists in the Oracle Business Intelligence Enterprise Edition component of Oracle Analytics affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0. This vulnerability allows a low-privileged attacker with logon access to the infrastructure to potentially take over the Oracle Business Intelligence Enterprise Edition. The CVSS 3.1 base score is 7.8, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released security patches addressing this and many other vulnerabilities in their September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk.
A vulnerability (CVE-2026-83289) exists in Oracle Business Intelligence Enterprise Edition (component: Analytics Web General) affecting versions 8.2.0.0.0, 12.2.1.4.0, and 26.1.0.0.0. It allows a low privileged attacker with network access via SOAP to potentially take over the product. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released a Critical Security Patch Update (CSPU) in September 2026 addressing this and many other vulnerabilities. Oracle strongly recommends applying the available patches promptly to mitigate this risk.
CVE-2026-83200 is a vulnerability in the Oracle Process Manufacturing Intelligence product of Oracle E-Business Suite (component: Internal Operations). It affects supported versions 12.2.3 through 12.2.15. The flaw allows a low-privileged attacker with network access via Oracle Net to gain unauthorized access to critical data within the product. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity with high confidentiality impact but no integrity or availability impact. Oracle has addressed this vulnerability in their September 2026 Critical Security Patch Update.
Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affected are 17.0-26.7. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Deployment. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Deployment accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Deployment accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
A vulnerability exists in the Oracle Alert product of Oracle E-Business Suite (component: Internal Operations) affecting versions 12.2.3 through 12.2.15. This vulnerability allows a low privileged attacker with network access via HTTP to compromise Oracle Alert, potentially leading to complete takeover. The CVSS 3.1 base score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has included this vulnerability in its September 2026 Critical Security Patch Update, which provides patches for affected versions.
A vulnerability exists in Oracle Forms, part of Oracle Fusion Middleware, affecting versions 12.2.1.19.0 and 14.1.2.0.0. The flaw allows a low privileged attacker with network access via HTTP to potentially take over Oracle Forms. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released security patches addressing this and many other vulnerabilities in their September 2026 Critical Security Patch Update.
A high-severity vulnerability (CVE-2026-83086) exists in Oracle Siebel CRM Cloud Applications, specifically in the Siebel Cloud Manager component. It affects supported versions from 22.3 through 26.7. The vulnerability allows a low-privileged attacker with network access via HTTP to potentially take over the Siebel CRM Cloud Applications. The CVSS 3.1 base score is 8.8, indicating high impact on confidentiality, integrity, and availability. Oracle has released security patches addressing this and many other vulnerabilities in their September 2026 Critical Security Patch Update. Customers are strongly advised to apply these patches promptly to mitigate the risk.
A vulnerability in Oracle JDeveloper component of Oracle Fusion Middleware (ADF Shared Components) affects versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low privileged attacker with network access via HTTP to cause unauthorized modification of critical data or cause denial of service by crashing the application. The vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity with impacts on integrity and availability. Oracle has released security patches addressing this and many other vulnerabilities in their September 2026 Critical Security Patch Update advisory.
A vulnerability in Oracle WebCenter Enterprise Capture (component: Client Bundle) affects versions 12.2.1.4.0 and 14.1.2.0.0. It requires an attacker to have access to the physical communication segment and involves user interaction from a third party. Successful exploitation can lead to full takeover of the product and may impact additional Oracle products. The vulnerability has a CVSS 3.1 base score of 7.9, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has released patches addressing this and many other vulnerabilities in their September 2026 Critical Security Patch Update.
A vulnerability exists in Oracle WebCenter Enterprise Capture (component: Client Bundle) versions 12.2.1.4.0 and 14.1.2.0.0. It allows a low-privileged attacker with network access via HTTP to gain unauthorized access to critical data and perform unauthorized updates, inserts, or deletes on accessible data. The vulnerability has a CVSS 3.1 base score of 8.5, indicating high severity with significant confidentiality and integrity impacts. Oracle has released security patches addressing this vulnerability as part of its September 2026 Critical Security Patch Update.
Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
Concrete CMS versions 9.0.0 through 9.5.2 contain a Server-Side Request Forgery (SSRF) vulnerability involving remote file import and DNS pin reuse. A low-privileged authenticated user allowed to import files can exploit this by supplying a DNS-rebinding host that resolves differently during validation and download, enabling access to internal resources. The vulnerability has a low CVSS v4.0 score of 2.1.
CVE-2026-68950 is a vulnerability in Digital Watchdog VMAX A1 G4 DVR devices caused by the use of hard-coded credentials. This flaw allows an attacker to run the ftpd service as root, granting remote root-level file access if FTP is reachable. The vulnerability has a high severity score of 8.8 and affects local network access scenarios.
A vulnerability in Oracle VM VirtualBox version 7.2.16 allows a high privileged attacker with logon access to cause a denial of service by hanging or crashing the product. This affects availability but does not impact confidentiality or integrity. The CVSS 3.1 base score is 6.0, indicating medium severity. Oracle strongly recommends applying security patches promptly. No specific patch information for this vulnerability is provided in the advisory.
CVE-2026-56975 is a denial of service vulnerability in the Cellular Modem component of Google Android. It arises from improper input validation, allowing a remote attacker in proximity to cause a denial of service without requiring user interaction or additional privileges. The vulnerability has a medium severity rating with a CVSS score of 6.5.
A vulnerability in the Prolink 13A Smart Plug Model DS-3202M-UKv3 Wi-Fi and its mEzee 2.6.7 application allows attackers to cause a Denial of Service (DoS) or redirect the device to connect to an attacker-controlled device by sending a crafted packet during the provisioning phase.
On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authentication sessions. Repeated exploitation of this issue can exhaust available authentication resources, resulting in legitimate users being unable to log in to the device.
This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.