Unauthorized data compromise in Oracle TeleSales (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all TeleSales-accessible data. The flaw is rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, and is tagged as an authentication-bypass-class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Trading Community (Oracle E-Business Suite, Party Search UI component) allows a low-privileged attacker with network HTTP access to read and modify all data accessible to the Trading Community module. Fixed in the Oracle Critical Patch Update of July 2026 (CPUJUL2026), the flaw affects EBS releases 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; the vendor tag 'Authentication Bypass' suggests the Party Search UI may permit access beyond the attacker's intended authorization scope.
Unauthorized data compromise in Oracle Payments (Oracle E-Business Suite, File Transmission component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the Payments module over HTTP. Oracle rates it CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and it is addressed in the Oracle Critical Patch Update of July 2026. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor 'Authentication Bypass' tag and low attack complexity make it an attractive target in EBS-exposed environments.
Data compromise in Oracle Complex Maintenance, Repair and Overhaul (cMRO), a module of Oracle E-Business Suite versions 12.2.3 through 12.2.15, allows a low-privileged authenticated attacker with HTTP network access to read and modify critical application data. The flaw affects the Internal Operations component and yields high confidentiality and integrity impact (CVSS 8.1) with no availability effect. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a fix ships in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Assets (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all Oracle Assets-accessible data. The CVSS 3.1 base score is 8.1 with high confidentiality and integrity impact but no availability impact, reflecting a data-integrity and disclosure risk rather than a service outage. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; it was disclosed in Oracle's July 2026 Critical Patch Update.
Compromise of Oracle Cost Management (Internal Operations component) in Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the module, resulting in high confidentiality and integrity impact but no availability impact. The flaw is rated easily exploitable (CVSS 3.1 8.1, PR:L) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle E-Business Intelligence (Definition component) of Oracle E-Business Suite versions 12.2.3 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the product. The CVSS 3.1 vector (8.1) reflects High confidentiality and integrity impact with no availability effect, meaning an authenticated user can escalate their reach to critical business intelligence data without needing elevated roles. No public exploit identified at time of analysis, and the flaw is addressed in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Price Protection (a module of Oracle E-Business Suite 12.2.3 through 12.2.15) allows a low-privileged attacker with network HTTP access to read, create, delete, or modify all Price Protection-accessible data. The flaw carries a CVSS 3.1 base score of 8.1 (C:H/I:H) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in the Oracle Process Manufacturing (OPM) Inventory module of Oracle E-Business Suite 12.2.3-12.2.15 lets a low-privileged, authenticated network attacker read and modify all OPM Inventory-accessible data over HTTP. Rated CVSS 3.1 8.1 (High) for combined Confidentiality and Integrity impact with no availability effect, it was reported by Oracle's own security team and fixed in the July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, and it is not on CISA KEV.
Data compromise in Oracle U.S. Federal Financials (a module of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) lets an authenticated low-privileged attacker reach the Internal Operations component over HTTP and read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with confidentiality and integrity impact but no availability impact; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. Disclosed via Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle PeopleSoft Enterprise CS Student Records 9.2.38 (Research Tracking component) lets a low-privileged, network-authenticated attacker over HTTPS read, create, delete, or modify all data accessible to the module. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact), it was disclosed in Oracle's July 2026 Critical Patch Update and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Broad data compromise in Oracle Identity Manager 12.2.1.4.0 and 14.1.2.1.0 (Fusion Middleware REST WebServices component) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the identity platform. Tagged as an authentication-bypass class issue with CVSS 3.1 8.1, it grants high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis, and it is addressed in the Oracle Critical Patch Update of July 2026.
Data compromise in Oracle Unified Directory 12.2.1.4.0 and 14.1.2.1.0 (OUD Core component of Oracle Fusion Middleware) allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all directory-accessible data over LDAP. Rated CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact, the flaw is described by Oracle as 'easily exploitable' and is tagged as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle E-Business Suite's Document Management and Collaboration module (Attachments component) lets a low-privileged, network-adjacent attacker read, create, modify, or delete all data accessible to the module across supported releases 12.2.3 through 12.2.15. Oracle rates it CVSS 8.1 with high confidentiality and integrity impact but no availability effect, and flags it as 'easily exploitable' - meaning any authenticated EBS user can weaponize it over HTTP. There is no public exploit identified at time of analysis and it is not on CISA KEV, but Oracle EBS Attachments flaws have historically been high-value targets.
Data compromise in Oracle Product Hub (Oracle E-Business Suite Item Catalog component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, delete, or modify all Product Hub-accessible data. The CVSS 3.1 base score is 8.1, reflecting high confidentiality and integrity impact with no availability effect. No public exploit identified at time of analysis and it is not listed in CISA KEV, but Oracle E-Business Suite flaws are attractive targets and this issue is fixed in the July 2026 Critical Patch Update.
Data compromise in Oracle Universal Work Queue (Oracle E-Business Suite component UWQ Server Issues), versions 12.2.3 through 12.2.15, lets a remote unauthenticated attacker read and modify all UWQ-accessible data (C:H/I:H) by luring an authenticated user into interacting with attacker-supplied content over HTTP. The CVSS 3.1 base score is 8.1, driven by high confidentiality and integrity impact with no availability effect. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; Oracle addressed it in the July 2026 Critical Patch Update.
Memory corruption in Zephyr RTOS v4.3.0 and v4.4.0 lets any device acting as the I2C bus master corrupt an adjacent target device through the unauthenticated MCTP-over-I2C+GPIO target binding. By selecting the data pseudo-register and writing a byte before sending the length register, an attacker triggers a write through an unallocated (NULL) mctp_pktbuf pointer, and a separate write-then-check bug permits a one-byte heap overflow past data[255]; both yield memory corruption or a hard fault. No public exploit identified at time of analysis, and it is not on CISA KEV, but a vendor patch and security advisory are available.
Unauthorized data compromise in Oracle Contracts Integration (Internal Operations component of Oracle E-Business Suite versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. The flaw carries a CVSS 3.1 base score of 8.1 (high confidentiality and integrity impact, no availability impact) and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Lease and Finance Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-adjacent attacker to read, create, delete, or modify all application-accessible data over HTTP. The CVSS 3.1 base score is 8.1 (C:H/I:H), reflecting full confidentiality and integrity impact with no availability effect. This CVE was disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Data compromise in Oracle Process Manufacturing Regulatory Management (a component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the component. Oracle rates it CVSS 3.1 8.1 with high confidentiality and integrity impact but no availability impact. There is no public exploit identified at time of analysis and it is not in CISA KEV; an 'Authentication Bypass' tag is noted in intelligence sources but is not corroborated by the CVSS vector, which requires low privileges (PR:L).
Data compromise in Oracle Identity Manager (OIM Legacy UI component) versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the identity platform. The flaw is tracked in Oracle's July 2026 Critical Patch Update and carries a CVSS 3.1 score of 8.1 with high confidentiality and integrity impact. No public exploit has been identified at time of analysis, but the low attack complexity and network vector make it a strong patching priority for enterprise IAM deployments.
Full takeover of Oracle Commerce Platform 11.4.0 is possible by a remote unauthenticated attacker who reaches the Dynamo Application Framework component over HTTP, per Oracle's July 2026 Critical Patch Update. Successful exploitation compromises confidentiality, integrity, and availability of the platform (CVSS 3.1 8.1), though Oracle rates it difficult to exploit (AC:H). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Full takeover of Oracle Scripting, the scripted-interaction module of Oracle E-Business Suite (Internal Operations component), is possible by a remote unauthenticated attacker over HTTP in supported releases 12.2.3 through 12.2.15. Because the CVSS vector carries high confidentiality, integrity, and availability impact (8.1), a successful attack yields complete compromise of the module rather than mere data exposure, though the high attack complexity (AC:H) means exploitation is not trivial. There is no public exploit identified at time of analysis and the flaw is not on the CISA KEV list.
Full takeover of the Oracle Applications Technology Stack is possible in Oracle E-Business Suite 12.2.3 through 12.2.15 via the Client System Analyzer component, which is reachable over HTTP by unauthenticated network attackers. Exploitation is rated difficult (high attack complexity) but a successful attack yields complete confidentiality, integrity, and availability compromise. Disclosed in Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content is possible in the Content Server component of Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a remote unauthenticated attacker reaching the server over HTTP can achieve complete takeover with full confidentiality, integrity, and availability impact. The flaw carries a CVSS 3.1 base score of 8.1, tempered by high attack complexity (AC:H) that makes reliable exploitation difficult. No public exploit identified at time of analysis, and it is not listed in CISA KEV, so risk is currently theoretical pending patch application from the Oracle July 2026 Critical Patch Update.
Full compromise of Oracle WebCenter Content (Content Server component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where an unauthenticated remote attacker with HTTPS network access can achieve complete takeover of the product. The CVSS 3.1 base score is 8.1 with high confidentiality, integrity, and availability impact, though the flaw is rated difficult to exploit (AC:H). No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Full takeover of Oracle Access Manager (Fusion Middleware) is possible via a network-based HTTP attack against the Authentication Engine component in supported versions 12.2.1.4.0 and 14.1.2.1.0. An unauthenticated remote attacker (PR:N) can achieve complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H), though Oracle rates the attack complexity as high (AC:H), meaning exploitation is difficult and likely requires specific conditions or timing to succeed. This was disclosed in the Oracle Critical Patch Update of July 2026; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle Coherence is possible by an unauthenticated remote attacker over TCP, per Oracle's July 2026 Critical Patch Update. The flaw affects the Core component across Coherence 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0, and yields complete loss of confidentiality, integrity and availability (CVSS 3.1 8.1). Exploitation is rated high-complexity, and no public exploit has been identified at time of analysis.
Full takeover of Oracle Coherence is possible when a remote, unauthenticated attacker reaches the product over TCP and successfully exploits a hard-to-trigger flaw in the Core component, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 8.1). Affected supported releases are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0, all addressed in Oracle's July 2026 Critical Patch Update. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Cross-site scripting in DayuanJiang next-ai-draw-io 0.4.13 lets a remote unauthenticated attacker inject arbitrary script through the mcp parameter, executing in the victim's browser when they open a crafted link. The 'arbitrary code' claim and RCE tag in the source data most plausibly refer to arbitrary JavaScript in the browser (CWE-79 reflected XSS) rather than server-side code execution. EPSS is low (0.29%, 21st percentile), there is no CISA KEV listing, and no public exploit is confirmed, though third-party GitHub writeups referencing this CVE exist.
Data compromise in Oracle Installed Base (Create Item Instance component) of Oracle E-Business Suite versions 12.2.4 through 12.2.15 allows a low-privileged attacker with HTTP network access to read, create, modify, or delete all data accessible to the Installed Base module. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and was disclosed in Oracle's July 2026 Critical Patch Update. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score provided in the source data.
Unauthorized data compromise in Oracle Work in Process (a manufacturing module of Oracle E-Business Suite) 12.2.14 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the Work in Process application. Oracle rates it 8.1 (CVSS 3.1) with high confidentiality and integrity impact but no availability impact, and describes it as easily exploitable. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Broad data compromise in Oracle E-Business Suite Secure Enterprise Search (Search Integration Engine) affects EBS versions 12.2.3 through 12.2.15, where a network attacker with only low-level authenticated access over HTTP can read, create, modify, or delete all data accessible to the Secure Enterprise Search component. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:N) rates it 8.1 High, reflecting low attack complexity and full confidentiality and integrity impact without availability loss. No public exploit identified at time of analysis, though the vendor's 'Authentication Bypass' tagging suggests weak access-control enforcement in the affected component.
Unauthorized data compromise in Oracle Commerce Guided Search / Experience Manager 11.4.0 (Experience Manager component) allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all data accessible to the application. Rated CVSS 3.1 8.1 (C:H/I:H, no availability impact) and tagged as an authentication-bypass-class issue by the reporter. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a fix ships in Oracle's July 2026 Critical Patch Update.
Data compromise in Oracle Customers Online (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all data accessible to the application. Oracle rates this CVSS 8.1 with high confidentiality and integrity impact but no availability impact, and the intelligence tag 'Authentication Bypass' suggests horizontal privilege escalation past intended access boundaries. No public exploit identified at time of analysis, and the flaw is fixed in the Oracle Critical Patch Update of July 2026.
Data compromise in Oracle Applications Framework (12.2.3 through 12.2.15), a core component of Oracle E-Business Suite, allows a low-privileged authenticated attacker with HTTP network access to read, create, modify, or delete all data accessible to the framework via the Graph/Charting component. The Oracle-assigned CVSS 3.1 base score is 8.1 (C:H/I:H) with no availability impact, and Oracle rates it 'easily exploitable.' There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vendor-supplied 'Authentication Bypass' tag suggests low authentication barriers relative to the damage achievable.
Data compromise in Oracle Financials Common Modules (Common Components) within Oracle E-Business Suite 12.2.3 through 12.2.15 allows a low-privileged, network-authenticated attacker over HTTP to read, create, delete, or modify all data accessible to the module. Oracle rates it CVSS 3.1 8.1 (high confidentiality and integrity impact, no availability impact) and tags it as an authentication-bypass-class issue. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Cash Management (Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 lets a low-privileged attacker with HTTP network access read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact, it was reported by Oracle and disclosed in the July 2026 Critical Patch Update. No public exploit identified at time of analysis and it is not listed in CISA KEV, though low attack complexity and network reachability make it a notable patch priority for EBS operators.
Data compromise in Oracle Sales Offline (a module of Oracle E-Business Suite, Internal Operations component) versions 12.2.3 through 12.2.15 allows a low-privileged, authenticated attacker with HTTP network access to read, create, delete, or modify all data accessible to the application. Rated CVSS 3.1 8.1 (High) with full confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis; not listed in CISA KEV.
Unauthorized data compromise in Oracle iReceivables (Oracle E-Business Suite, AR Web Utilities component) versions 12.2.3 through 12.2.15 allows a low-privileged, network-based attacker over HTTP to read, create, modify, or delete all iReceivables-accessible data. Oracle rates it CVSS 3.1 8.1 (High) with High confidentiality and integrity impact but no availability impact, and the vendor/community has tagged it as an authentication-bypass class issue. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the low attack complexity and network vector make it a strong patching priority for exposed EBS deployments.
Data compromise in Oracle EDI Gateway (Oracle E-Business Suite 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify all EDI Gateway-accessible data, including critical data. Rated CVSS 8.1, the flaw is disclosed in Oracle's July 2026 Critical Patch Update and tagged as an authentication-bypass-class issue; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Unauthorized data compromise in Oracle Process Manufacturing Financials (Internal Operations component of Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged, network-based attacker to read, create, delete, or modify all data accessible to the application over HTTP. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and Oracle flags it as easily exploitable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Data compromise in Oracle Content Manager (Oracle E-Business Suite, Internal Operations component), versions 12.2.3 through 12.2.15, lets a low-privileged attacker with HTTP network access read, create, modify, or delete all Content Manager-accessible data. The CVSS 3.1 base score is 8.1 (C:H/I:H, no availability impact), reflecting high confidentiality and integrity damage without service disruption. No public exploit identified at time of analysis and it is not listed in CISA KEV; the Oracle-supplied 'Authentication Bypass' tag conflicts with the PR:L vector and should be treated cautiously.
Unauthorized data compromise in Oracle WebCenter Content (Web Content Management component) versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to read, create, modify, or delete all content-server-accessible data. Oracle rates this 8.1 (High) with confidentiality and integrity fully impacted but no availability effect, and the intelligence tags flag an authentication-bypass angle. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix ships in the July 2026 Oracle Critical Patch Update.
Compromise of Oracle Product Workbench (a Security component of Oracle E-Business Suite) allows a low-privileged, network-based attacker over HTTP to read, create, delete, or modify all data accessible to the application, per Oracle's July 2026 Critical Patch Update. The flaw carries a CVSS 3.1 base score of 8.1 with high confidentiality and integrity impact but no availability impact, and affects EBS versions 12.2.3 through 12.2.15. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle rates it 'easily exploitable.'
Takeover of Oracle Workflow in Oracle E-Business Suite (versions 12.2.3 through 12.2.15) is possible when an unauthenticated attacker reaches the Workflow Notification Mailer over SMTP. The high-difficulty flaw (CVSS 3.1 base 8.1, AC:H) yields full compromise of the Workflow component with confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Server takeover in Oracle WebLogic Server (Fusion Middleware, Core component) lets an unauthenticated remote attacker fully compromise affected instances by abusing the proprietary T3 and IIOP remote protocols. Supported releases 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are vulnerable, and successful exploitation yields complete confidentiality, integrity and availability loss. No public exploit identified at time of analysis; the flaw is rated high complexity (CVSS 8.1) and was disclosed in Oracle's July 2026 Critical Patch Update.
Adjacent-network compromise of Oracle Coherence (Oracle Fusion Middleware Core component) lets an unauthenticated attacker on the same physical communication segment read, create, delete, or modify all Coherence-accessible data. Rated CVSS 3.1 8.1, the flaw - tagged as an authentication bypass by the reporter (Oracle) - yields high confidentiality and integrity impact but no availability impact. No public exploit identified at time of analysis and not listed in CISA KEV; disclosed via the Oracle July 2026 Critical Patch Update.
Data compromise in the French HR component of Oracle HRMS within Oracle E-Business Suite (versions 12.2.3 through 12.2.15) lets a low-privileged attacker with HTTP network access read, create, delete, or modify critical HRMS (France) data. Rated CVSS 3.1 8.1 (High) with High confidentiality and integrity impact and no availability impact, Oracle characterizes it as easily exploitable with no user interaction required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Oracle's disclosure notes low attack complexity.
Data compromise in Oracle Time and Labor (Oracle E-Business Suite, versions 12.2.3 through 12.2.15) allows a low-privileged attacker with HTTP network access to read, create, delete, or modify all data accessible to the application. Oracle rates it CVSS 3.1 8.1 (C:H/I:H) and describes it as easily exploitable, though availability is unaffected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.