Threats affecting pkg:maven/com.oracle/Oracle-iSupplier-Portal

5 threats

Severity	CVSS	Signals	Threat	Source	Published
High	7.5	EPSS 0.4%	CVE-2026-70777Oracle iSupplier Portal · Improper Access Control High7.5EPSS 0.4%2026-08-18CVE Database V5CVE-2026-70777 CVE-2026-70777 is a vulnerability in Oracle iSupplier Portal versions 12.2.3 through 12.2.15. It allows an unauthenticated attacker with network access via HTTP to gain unauthorized access to critical or all accessible data within the portal. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with a high confidentiality impact but no impact on integrity or availability. Oracle has released a Critical Security Patch Update including fixes for this and other vulnerabilities, and strongly recommends applying patches promptly. EPSS 0.4%Vulnerability CWE-284	CVE Database V5	2026-08-18
Low	3.1	EPSS 0.2%	CVE-2026-60922Oracle iSupplier Portal · Information Exposure Low3.1EPSS 0.2%2026-07-21CVE Database V5CVE-2026-60922 Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSupplier Portal. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle iSupplier Portal accessible data. CVSS 3.1 Base Score 3.1 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). EPSS 0.2%Vulnerability CWE-200	CVE Database V5	2026-07-21
Low	3.7	EPSS 0.3%	CVE-2026-60919Oracle iSupplier Portal · Information Exposure Low3.7EPSS 0.3%2026-07-21CVE Database V5CVE-2026-60919 Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle iSupplier Portal. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle iSupplier Portal accessible data. CVSS 3.1 Base Score 3.7 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). EPSS 0.3%Vulnerability CWE-200	CVE Database V5	2026-07-21
High	7.5	EPSS 0.3%	CVE-2026-46957Oracle iSupplier Portal · Improper Access Control High7.5EPSS 0.3%2026-06-16CVE Database V5CVE-2026-46957 Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle iSupplier Portal. Successful attacks of this vulnerability can result in takeover of Oracle iSupplier Portal. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). EPSS 0.3%Vulnerability CWE-284	CVE Database V5	2026-06-16
High	8.0	EPSS 0.2%	CVE-2026-46894Oracle iSupplier Portal · Open Redirect High8.0EPSS 0.2%2026-06-16CVE Database V5CVE-2026-46894 Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Home Page). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle iSupplier Portal. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle iSupplier Portal. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). EPSS 0.2%Vulnerability CWE-601	CVE Database V5	2026-06-16

Page 1 of 1