2613
CVEs
510
Critical
1266
High
6
KEV
39
PoC
1710
Unpatched C/H
8.3%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
510
HIGH
1266
MEDIUM
708
LOW
129
Monthly CVE Trend
Affected Products (30)
MySQL
1197
Java
1024
Debian Linux
906
Oncommand Insight
757
Jre
747
Jdk
739
Ubuntu Linux
726
Fedora
595
Oncommand Workflow Automation
590
Active Iq Unified Manager
543
Solaris
496
Snapcenter
495
Opensuse
484
Enterprise Linux Server
413
Enterprise Linux Workstation
413
Enterprise Linux Desktop
410
Vm Virtualbox
404
Enterprise Linux Server Aus
394
Enterprise Linux Eus
363
Enterprise Linux Server Tus
348
Leap
333
Peoplesoft Enterprise Peopletools
329
MariaDB
327
Weblogic Server
288
E Business Suite
284
Mysql Server
283
Fusion Middleware
249
Enterprise Linux
233
Database Server
209
Outside In Technology
190
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2025-61882 | Unauthenticated remote takeover of Oracle E-Business Suite's Concurrent Processing tier (via the BI Publisher Integration component) affects supported releases 12.2.3 through 12.2.14, letting a network attacker with no credentials fully compromise the component over HTTP. Rooted in an authentication weakness (CWE-287), the flaw is confirmed actively exploited (CISA KEV) and was leveraged as a zero-day in a mass-exploitation campaign documented by CrowdStrike, with full confidentiality, integrity, and availability impact (CVSS 9.8). | CRITICAL | 9.8 | 99.7% | 234 |
KEV
PoC
No patch
|
| CVE-2025-61884 | Unauthenticated path traversal in Oracle Configurator's Runtime UI (part of Oracle E-Business Suite 12.2.3-12.2.14) exposes the complete data accessible to the Configurator application over plain HTTP with no prerequisites. The CISA KEV catalog references this CVE, and watchTowr Labs has published a pre-authentication RCE chain combining this flaw with CVE-2025-61882 - meaning confidentiality loss is the isolated impact, but chaining enables full system compromise. A publicly available exploit exists, and the July 2025 Oracle Critical Patch Update (CPU) addresses this vulnerability. | HIGH | 7.5 | 97.8% | 205 |
KEV
PoC
No patch
|
| CVE-2026-35273 | Remote takeover of Oracle PeopleSoft Enterprise PeopleTools 8.61 and 8.62 is possible through the Updates Environment Management component via unauthenticated HTTP requests. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N) indicates trivial network-based exploitation against any internet- or intranet-exposed instance, with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, but Oracle's 'easily exploitable' language and the unauthenticated nature make this a high-priority patching target. | CRITICAL | 9.8 | 0.0% | 124 |
KEV
PoC
No patch
|
| CVE-2026-21962 | Oracle HTTP Server and WebLogic Server Proxy Plug-in have a CVSS 10.0 access control vulnerability allowing unauthenticated network attackers to fully compromise the middleware layer. | CRITICAL | 10.0 | 0.0% | 120 |
KEV
PoC
|
| CVE-2026-46817 | Remote takeover of Oracle Payments in Oracle E-Business Suite versions 12.2.3 through 12.2.15 is possible via the File Transmission component, allowing unauthenticated network-based attackers to fully compromise confidentiality, integrity, and availability (CVSS 9.8). The flaw is described by Oracle as easily exploitable over HTTP with no user interaction, and no public exploit identified at time of analysis. Tagged as Information Disclosure and listed in Oracle's May 2026 Critical Patch Update advisory. | CRITICAL | 9.8 | 0.0% | 119 |
KEV
PoC
No patch
|
| CVE-2026-55255 | Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing the victim's flow UUID as the `model` value to the `/api/v1/responses` endpoint, exposing data the victim's flow processes and consuming their resources. The flaw is an Insecure Direct Object Reference (CWE-639) in the `get_flow_by_id_or_endpoint_name` helper, which skipped ownership checks on the UUID lookup path. Publicly available exploit code exists (a working curl PoC), and the input lists it as confirmed actively exploited (CISA KEV), though the SSVC exploitation status of 'poc' and a low 0.24% EPSS complicate that claim (see risk_assessment). | HIGH | 8.4 | 0.2% | 112 |
KEV
PoC
|
| CVE-2026-69240 | SQL injection in the Sequelize Node.js ORM (versions prior to 6.37.4) allows remote attackers to inject arbitrary SQL through application values that reach the string-escaping routine, but only when the ORM is configured with the Oracle dialect. The escape() function in sql-string.js returns any string beginning with TO_TIMESTAMP or TO_DATE verbatim without doubling single quotes, letting a crafted value break out of the intended literal. Publicly available exploit code exists in the GitHub Security Advisory (GHSA-v8fg-2rw7-q452); there is no CISA KEV listing and no EPSS score was provided. | CRITICAL | 9.8 | 0.3% | 69 |
PoC
|
| CVE-2026-21992 | A critical authentication bypass vulnerability in Oracle Identity Manager and Oracle Web Services Manager allows remote attackers to completely compromise affected systems without any credentials. The vulnerability resides in the REST WebServices and Web Services Security components, affecting versions 12.2.1.4.0 and 14.1.2.1.0 of both products. With a CVSS score of 9.8 and no authentication required, this represents a severe risk to identity management infrastructure, though no current KEV listing or public POC has been documented in available sources. | CRITICAL | 9.8 | 0.0% | 69 |
PoC
No patch
|
| CVE-2026-49952 | Authentication bypass in Discuz! X5.0 releases 20260320 through 20260501 allows unauthenticated remote attackers to access database backup and restore functionality exposed by dbbak.php. The flaw stems from a shared cryptographic key (CWE-323) between UCenter integration and the backup API, which lets an attacker abuse an encryption oracle in logging_ctl::logging_more() to mint legitimately signed authorization tokens, and chain a race condition to impersonate arbitrary users. Publicly available exploit code exists and an upstream fix has been published on Gitee. | CRITICAL | 9.3 | 0.4% | 67 |
PoC
|
| CVE-2026-33439 | Remote code execution in OpenIdentityPlatform OpenAM 16.0.5 and earlier allows unauthenticated attackers to execute arbitrary OS commands via unsafe Java deserialization of the jato.clientSession HTTP parameter. This bypass exploits an unpatched deserialization sink in JATO's ClientSession.deserializeAttributes() that was overlooked when CVE-2021-35464 was mitigated. Attackers can target any JATO ViewBean endpoint with <jato:form> tags (commonly found in password reset pages) using a PriorityQue | CRITICAL | 9.3 | 0.1% | 67 |
PoC
|
| CVE-2026-45623 | Arbitrary file read in PostCSS (npm postcss <= 8.5.11) lets an attacker who controls CSS input embed a `/*# sourceMappingURL=PATH */` comment that the PreviousMap parser dereferences directly against the local filesystem with no scheme, allowlist, or traversal check. Because the read fires under default options (no `from`, `map`, or plugins), any pipeline that processes untrusted CSS is reachable; when the resulting `JSON.parse` SyntaxError is surfaced to the caller it leaks roughly the first 10 bytes of the targeted file, and the same code path yields a file-existence oracle and a DoS primitive. Publicly available exploit code exists (POC), but there is no public evidence of active exploitation, and EPSS is low at 0.50% (40th percentile). | CRITICAL | 9.1 | 0.5% | 66 |
PoC
|
| CVE-2026-53727 | Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsing server to issue arbitrary HTTP/HTTPS GET requests, and via an attacker-controlled 3xx redirect to a file:// URI, escalate to arbitrary local file disclosure. The flaw sits in CssParser::Parser#read_remote_file, reachable through load_uri! and any add_block! call that supplies base_uri: - Premailer being the canonical consumer - so a single attacker-planted @import url(...) in parsed CSS reaches the sink. Publicly available exploit code exists (author-supplied PoC); there is no public exploit identified as being used in active campaigns, and it is not listed in CISA KEV. | HIGH | 8.9 | 0.5% | 65 |
PoC
|
| CVE-2025-30156 | Broken cryptography in Ceph's CephX authentication subsystem enables credential scope escalation and plaintext inference for any network-adjacent attacker holding a compromised Ceph account. CephX employed AES-CBC with a hardcoded initialization vector and no message authentication code, making encrypted authentication traffic both deterministic (identical plaintexts yield identical ciphertexts) and malleable (bit-flip attacks alter decrypted credential payloads undetected). Fixed in Ceph Tentacle 20.2.4 and Squid 19.2.6 by replacing the scheme with AES-256-CTS-HMAC-SHA384-192; no public exploit has been identified at time of analysis. | HIGH | 8.9 | 0.1% | 65 |
PoC
No patch
|
| CVE-2026-55509 | Blind SQL injection in WsgiDAV's MySQLBrowserProvider sample module (versions <= 4.3.4) allows unauthenticated network attackers to read arbitrary data from the backing MySQL database via URL path manipulation. The record key segment of the URL is concatenated directly into a WHERE clause without escaping, enabling a boolean status-code oracle that supports full character-by-character data extraction. A secondary typo in the numeric-type check (`INTT` instead of `INT`) ensures all primary key types take the vulnerable quoted branch, and a working PoC with complete extraction script has been publicly confirmed. No public exploit identified as confirmed actively exploited (CISA KEV), but the PoC lowers the exploitation bar significantly. | HIGH | 8.8 | 0.4% | 64 |
PoC
|
| CVE-2026-69247 | PKCS#7 EnvelopedData decryption in the Python cryptography library (versions 44.0.0-49.x) leaks a Bleichenbacher oracle through four distinguishable error messages and timing side-channels during RSA PKCS#1 v1.5 key unwrapping, exposing the exact recovered plaintext length in one case. An attacker who can submit crafted EnvelopedData to an auto-decrypting service - such as an S/MIME gateway or mail filter that reflects outcomes at high volume - can adaptively recover the content-encryption key and decrypt intercepted messages. No public exploit has been identified at time of analysis, and exploitation requires very specific deployment conditions; the fix in version 50.0.0 applies RFC 3218 indistinguishability by substituting a random key on any failure. | HIGH | 8.2 | 0.2% | 61 |
PoC
|