1555
CVEs
241
Critical
1017
High
0
KEV
9
PoC
1251
Unpatched C/H
1.3%
Patch Rate
0.3%
Avg EPSS
Severity Breakdown
CRITICAL
241
HIGH
1017
MEDIUM
254
LOW
43
Monthly CVE Trend
Affected Products (30)
MySQL
1197
Java
1037
Debian Linux
906
Oncommand Insight
757
Jre
747
Jdk
739
Ubuntu Linux
726
Fedora
595
Oncommand Workflow Automation
590
Active Iq Unified Manager
543
Solaris
496
Snapcenter
495
Opensuse
484
Enterprise Linux Server
413
Enterprise Linux Workstation
413
Enterprise Linux Desktop
410
Vm Virtualbox
404
Enterprise Linux Server Aus
394
Enterprise Linux Eus
363
Enterprise Linux Server Tus
348
Leap
333
Peoplesoft Enterprise Peopletools
329
MariaDB
327
Weblogic Server
288
E Business Suite
284
Mysql Server
283
Fusion Middleware
250
Enterprise Linux
233
Database Server
209
Outside In Technology
190
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-30156 | Broken cryptography in Ceph's CephX authentication subsystem enables credential scope escalation and plaintext inference for any network-adjacent attacker holding a compromised Ceph account. CephX employed AES-CBC with a hardcoded initialization vector and no message authentication code, making encrypted authentication traffic both deterministic (identical plaintexts yield identical ciphertexts) and malleable (bit-flip attacks alter decrypted credential payloads undetected). Fixed in Ceph Tentacle 20.2.4 and Squid 19.2.6 by replacing the scheme with AES-256-CTS-HMAC-SHA384-192; no public exploit has been identified at time of analysis. | HIGH | 8.9 | 0.1% | 65 |
PoC
No patch
|
| CVE-2026-55509 | Blind SQL injection in WsgiDAV's MySQLBrowserProvider sample module (versions <= 4.3.4) allows unauthenticated network attackers to read arbitrary data from the backing MySQL database via URL path manipulation. The record key segment of the URL is concatenated directly into a WHERE clause without escaping, enabling a boolean status-code oracle that supports full character-by-character data extraction. A secondary typo in the numeric-type check (`INTT` instead of `INT`) ensures all primary key types take the vulnerable quoted branch, and a working PoC with complete extraction script has been publicly confirmed. No public exploit identified as confirmed actively exploited (CISA KEV), but the PoC lowers the exploitation bar significantly. | HIGH | 8.8 | 0.4% | 64 |
PoC
|
| CVE-2026-63642 | Unauthenticated Server-Side Request Forgery in MagicMirror² versions prior to 2.37.0 allows any network-reachable attacker to weaponize the smart mirror as an internal network probe. By connecting to the unguarded Socket.IO `/newsfeed` namespace and emitting a `CHECK_ARTICLE_URL` notification with an attacker-controlled URL, the server performs an unsanitized `fetch()` HEAD request and returns timing and framing data via `ARTICLE_URL_STATUS`, creating a boolean-plus-timing oracle for internal host and port enumeration. A proof-of-concept exploit is documented in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been reported. | MEDIUM | 6.3 | 0.4% | 52 |
PoC
|
| CVE-2026-70921 | Authentication bypass in Oracle Hyperion Financial Management 11.2.25.0.000 (Security component) lets a remote, unauthenticated attacker reach the application over TLS and read or alter all data the product can access, with a scope-changing blast radius into adjacent Oracle products. Rated CVSS 10.0, it is trivially exploitable (AV:N/AC:L/PR:N/UI:N) and delivers full confidentiality and integrity compromise while leaving availability untouched. No public exploit identified at time of analysis, and it is not listed in CISA KEV, but the perfect score and unauthenticated network reach make it a top-priority patch. | CRITICAL | 10.0 | 0.4% | 50 |
No patch
|
| CVE-2026-61241 | Complete takeover of Oracle Internet Directory (OID) is possible in Oracle Fusion Middleware versions 12.2.1.4.0 and 14.1.2.1.0 through its OID LDAP Server component, where an unauthenticated remote attacker with LDAP network access can fully compromise the directory service. Rated CVSS 10.0 with a scope change (S:C), successful exploitation can pivot beyond OID to significantly impact additional products that depend on it. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the maximum severity and identity-infrastructure role make this a top-priority patch. | CRITICAL | 10.0 | 0.4% | 50 |
No patch
|
| CVE-2026-70880 | Complete takeover of Oracle Hyperion Data Relationship Management 11.2.25.0.000 is possible by remote, unauthenticated attackers over TCP, per Oracle's August 2026 Critical Patch Update. The flaw sits in the Access and security component and carries a maximum CVSS 3.1 base score of 10.0 with a scope change, meaning successful exploitation can reach beyond DRM into additional connected products. No public exploit code has been identified at time of analysis, but the trivial exploitability (no authentication, low complexity) makes this a top-priority patch. | CRITICAL | 10.0 | 0.4% | 50 |
No patch
|
| CVE-2026-71133 | We need answer JSON only. Need obey. We have CVE data. Need synthesize. Let's inspect input. CVE-2026-71133 description: Vulnerability in Oracle Access Manager product of Oracle Fusion Middleware component Authentication Engine. Supported versions affected 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable allows unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. Scope change. Successful attacks result in takeover of Oracle Access Manager. CVSS 3.1 base 10.0 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Reported by Oracle. Tags: Information Disclosure, Oracle. References: Oracle CPU URL. Need product_name: "Oracle Access Manager" (3 words? Oracle Access Manager = 3). summary original synthesis, not copy description. technical_context with CWE N/A, CPE absent. risk_assessment use signals: CVSS 10, EPSS? not provided. KEV? not provided. POC? not provided. Need mention missing. Since no EPSS/KEV/POC. exploit status: no public exploit identified at time of analysis. But CVSS critical. Need mention CVSS vector network, low complexity, no privileges, no user interaction, scope changed, high C/I/A. Patch available? Input has reference Oracle CPU URL, no exact patch version. Need patch availability? Oracle likely patches in CPU. But data says "Patch availability" not in input except references. We can say "Patch available per Oracle Critical Patch Update advisory (April 2026?)" Need not invent. Reference URL cspusep2026.html ambiguous (maybe CPU April 2026). We can cite advisory URL. Exact version: description lists supported versions 12.2.1.4.0 and 14.1.2.1.0 likely affected. No fix version in input. So patch status: "Patch available per vendor advisory" if input patch? There's no patch field; references include Oracle security alerts. We can use "Vendor advisory is the Oracle Critical Patch Update; specific patched versions not provided in this input." Need not assume patch. But remediation needs actionable. We can say refer to Oracle C | CRITICAL | 10.0 | – | 50 |
No patch
|
| CVE-2026-83020 | We need answer JSON only. Need follow precision. Need synthesize. We need parse CVE. Product: Oracle Platform Security for Java. Need product_name 1-3 words. Could be "Oracle Platform Security" maybe exactly. We need provide fields. Summary: Need original synthesis, not copy. Mention easily exploitable unauthenticated network HTTP, CVSS 10, scope change, takeover. No KEV or POC info provided. EPSS not provided. So no active exploitation known. Use "no public exploit identified at time of analysis" maybe. Need mention if KEV status? Not in data. Could say not listed in CISA KEV? Wait input has no KEV. Need only use confirmed actively exploited if KEV=YES. Since no KEV, say "not listed in CISA KEV at time of analysis"? The instructions say exploitation status: if neither "no public exploit identified at time of analysis". Could mention "not known to be actively exploited". KEV absent. Need avoid asserting no KEV? It's not provided, but we can say "No CISA KEV listing provided; no public exploit identified..." maybe. Technical context: Underlying Oracle Fusion Middleware component Centralized Thirdparty Jars. Java security. CWE N/A. Need use CPE? Not provided except product versions. CPE can infer maybe cpe:2.3:a:oracle:platform_security_for_java:12.2.1.4.0:*:*:*:*:*:*:*? Need maybe not exact but identify exact product. Need educational. Risk assessment: Must include gniezno once. Need compare signals: CVSS 10.0 network low complexity no privileges no user interaction scope changed all impacts. EPSS not provided. KEV absent. POC absent. SSVC? We can say due unauthenticated network and scope change, likely automatable? Actually not confirm automatable. Need risk assessment with available signals. Mention CVSS base score 10, but absence of EPSS/KEV requires caution. Need state missing: EPSS and POC status not provided; not in KEV from input. But can say "With a CVSS 10, unauthenticated network exploitation and scope change, this is a critical priority even for a mid- | CRITICAL | 10.0 | – | 50 |
No patch
|
| CVE-2026-83021 | We need answer JSON only. Need synthesize. Need be careful. We need infer product_name: Oracle WebLogic Server. Summary original not copy description. KEV? Input no KEV status? It doesn't mention KEV, POC, EPSS. Need use available. We should state no KEV? But exploitation status rules: If KEV=YES in input: confirmed; If POC=YES but no KEV; else no public exploit identified. Input no KEV, no POC. So "no public exploit identified at time of analysis". EPSS absent, no mention. Need not invent. CVSS 10.0 with vector. Authentication requirements: CVSS PR:N => unauthenticated. Patch? References Oracle advisory but no version fix? Affected versions listed. Patch status: no explicit patch data? Reference Oracle security alert likely advisory. Could say patch available per vendor advisory? Need not assume exact version. Input has patch availability? Not provided. "Reported by secalert" and advisory. Probably vendor released patch. But we don't know exact version. Patch status from rules: If input includes exact fix version -> vendor-released patch exact. If patch refs point to GitHub PR/commit -> upstream. If patch data says available but no version -> patch available per vendor advisory. Here no patch data except advisory reference. We can say "Vendor advisory available; exact patch version not identified in provided data." But patch status rule? Maybe "Patch available per vendor advisory" because reference to Oracle security alerts indicates patch. But provided data doesn't explicitly say patch available. However Oracle quarterly CPU. Use "Vendor advisory references Oracle Critical Patch Update; exact fixed version not independently confirmed from input." In remediation: "Apply Oracle's Critical Patch Update as detailed in Oracle Security Alert cspusep2026.html. Restrict access to WebLogic console/HTTP until patch can be applied." Need not invent exact version. Need technical_context: Explain WebLogic Server component Web Container, CWE-287 auth bypass. Use CPE? Input no | CRITICAL | 10.0 | – | 50 |
No patch
|
| CVE-2026-83059 | Takeover of Oracle Internet Directory via its LDAP server component allows unauthenticated remote attackers to fully compromise the directory service. Affected versions are 12.2.1.4.0 and 14.1.2.1.0. The vulnerability is rated CVSS 10.0 with scope change; no public exploit or CISA KEV listing was identified in the provided data. | CRITICAL | 10.0 | – | 50 |
No patch
|
| CVE-2026-83099 | We need produce JSON. Need follow user. We need synthesize. Need analyze CVE. Data: CVE-2026-83099 Oracle Forms, Fusion Middleware, Forms Services C/S Charmode. Versions 12.2.1.19.0 and 14.1.2.0.0. Description: easily exploitable unauthenticated network via HTTP compromise Oracle Forms, scope change, takeover. CVSS 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. CWE-287 improper authentication. Tags Authentication Bypass, Oracle. ENISA EUVD. References oracle security alert cspusep2026, nvd link. No KEV, no EPSS, no POC? In input there is no KEV/POC/EPSS/CPE? Actually tags and references. Need craft fields. Need plain text strings. Need include all. Need check: CVE ID maybe future 2026. Product name "Oracle Forms" (1-3 words) OK. Summary: Original synthesis, not copy. Start impact verb and product: "Critical authentication bypass in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 allows unauthenticated attackers..." Mention CVSS 10.0, network HTTP, scope change, CWE-287. No KEV/POC info because not given; say no public exploit identified, not in KEV? We can mention no active exploitation data? We should say "no public exploit identified at time of analysis" if neither. But exploitation status phrase required. Since no KEV, no POC, use phrase. But maybe no data, so yes. Summary must mention if actively exploited (KEV) if present, not. mention CVSS, EPSS if notable (none). "Critical authentication bypass vulnerability in Oracle Forms 12.2.1.19.0 and 14.1.2.0.0 enables unauthenticated HTTP attackers to completely compromise the Forms Services component, resulting in high confidentiality, integrity, and availability impact and potential takeover of Oracle Forms; Oracle's CVSS base score is 10.0 due to network attack vector, low complexity, no privileges or user interaction, and changed scope. No public exploit or active exploitation was identified in the provided intelligence." Good. Technical_context: Explain underlying technology: Oracle Forms part of Fusion Middleware, componen | CRITICAL | 10.0 | – | 50 |
No patch
|
| CVE-2026-87230 | We need answer in JSON only. Need synthesize. Need follow all instructions. We have CVE-2026-87230 Oracle Hyperion Financial Management 11.2.26.0.000, CVSS 10.0 vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. Description: easily exploitable unauthenticated network via HTTP, scope change, impacts confidentiality integrity. Tags: Authentication Bypass, Oracle. Reference Oracle security alert. No KEV, no POC, no EPSS given. Patch availability? Not explicitly. Need infer probably patch available via Oracle critical patch update? The reference cspusep2026.html likely CPU? "cspusep2026" maybe Critical Patch Update Security? It says reported. Need not state patch unless input includes exact? We don't have patch version, but reference likely vendor advisory. Need fabricate? We cannot invent. Could say "Vendor advisory available; patched version not specified in provided data." But remediation should cite advisory URL and recommend apply Oracle CPU, upgrade? Exact version unknown. Need careful. Need output JSON fields all strings. data_quality_flags array. We can have empty array? likely. Need maybe flag missing_tag? Tags include Authentication Bypass, Oracle. Product Hyperion. CVSS. CWE N/A. Could there be missing tag "oracle-hyperion"? Not needed? We shouldn't invent problems. Product name: Oracle Hyperion Financial Management. Need assess CVSS independent? The input vector is 10.0. Our assessed CVSS vector maybe same. Need assess CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N. CVSS 4.0 equivalent? Need map: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N? Scope changed? In CVSS 4.0, vulnerable system vs subsequent. Since vulnerability in Hyperion, impacts additional products, so VC/VI maybe H? Actually description: unauthorized creation deletion modification access to critical data or all Hyperion accessible data and unauthorized access... It says attacks may significantly impact additional products (scope change). CVSS 3.1 S:C C:H I:H A:N. That means vulnerable compon | CRITICAL | 10.0 | – | 50 |
No patch
|
| CVE-2026-61003 | Full takeover of Oracle Managed File Transfer (Oracle Fusion Middleware, MFT Runtime Server) is possible when a low-privileged attacker with network access reaches the T3 or IIOP protocol interface. The flaw carries a CVSS 3.1 base score of 9.9 and, critically, involves a scope change (S:C) so successful attacks may significantly impact additional products beyond MFT itself. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity, low privilege requirement, and network exposure via WebLogic-style T3/IIOP make it a high-priority patch. | CRITICAL | 9.9 | 0.5% | 50 |
No patch
|
| CVE-2026-60702 | Remote takeover of Oracle WebLogic Server is possible when a low-privileged attacker reaches the server over the T3 or IIOP protocols, abusing a flaw in the Core component to fully compromise the host. Supported versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0 are affected, and because the attack carries a scope change it can significantly impact products beyond WebLogic itself. Oracle rates it CVSS 9.9; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the CVSS profile matches historically weaponized WebLogic T3/IIOP deserialization bugs. | CRITICAL | 9.9 | 0.5% | 50 |
No patch
|
| CVE-2026-61206 | Privilege-escalating account takeover in Oracle Hyperion Calculation Manager 11.2.25.0.000 (Security component) lets a low-privileged, network-adjacent attacker send crafted HTTP requests that fully compromise the product and, because of a CVSS scope change, spill impact into additional connected Oracle Hyperion products. Oracle rates it CVSS 3.1 9.9 with full confidentiality, integrity, and availability loss; it was disclosed in Oracle's August 2026 Critical Patch Update. There is no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.5% | 50 |
No patch
|