Base de CVEs

CVE-2026-46922 Alta · 7.2 CWE-269 17/06/2026

Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component:...

Vulnerability in the Oracle HR Intelligence product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle HR Intelligence. Successful attacks of this vulnerability can result in takeover of Oracle HR Intelligence. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-46921 Alta · 8.8 CWE-269 17/06/2026

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component:...

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-46916 Alta · 8.8 CWE-269 17/06/2026

Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E...

Vulnerability in the Oracle Process Manufacturing Product Development product of Oracle E-Business Suite (component: Quality Management Specs). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Process Manufacturing Product Development. Successful attacks of this vulnerability can result in takeover of Oracle Process Manufacturing Product Development. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-46914 Alta · 7.1 CWE-269 17/06/2026

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The...

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11.4. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Solaris accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H).

CVE-2026-46903 Alta · 8.8 CWE-269 17/06/2026

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component:...

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infrastructure Security). Supported versions that are affected are 9.2.0.0-9.2.26.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-46901 Crítica · 9.9 CWE-269 17/06/2026

Vulnerabilidade de Gerenciamento Inadequado de Privilégios no Oracle Enterprise Command Center Framework (E-Business Suite)

Vulnerabilidade no produto Oracle Enterprise Command Center Framework do Oracle E-Business Suite (componente: Core). As versões suportadas afetadas são V15 e V16. Vulnerabilidade facilmente explorável por atacante com baixo privilégio e acesso à rede via HTTP para comprometer o Oracle Enterprise Command Center Framework. Embora a vulnerabilidade esteja no Oracle Enterprise Command Center Framework, ataques podem impactar significativamente produtos adicionais (mudança de escopo). Ataques bem-sucedidos podem resultar em acesso não autorizado para criação, exclusão ou modificação de dados críticos ou de todos os dados acessíveis do Oracle Enterprise Command Center Framework, bem como acesso não autorizado a dados críticos ou acesso completo a todos os dados acessíveis do Oracle Enterprise Command Center Framework e capacidade não autorizada de causar negação de serviço parcial (partial DOS) do Oracle Enterprise Command Center Framework. CVSS 3.1 Base Score 9.9 (impactos de Confidencialidade, Integridade e Disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L).

CVE-2026-46900 Crítica · 9.9 CWE-269 17/06/2026

Oracle Enterprise Command Center Framework: gerenciamento impróprio de privilégios (CVE-2026-46900)

Vulnerabilidade no produto Oracle Enterprise Command Center Framework do Oracle E-Business Suite (componente: Core). As versões suportadas afetadas são V15 e V16. Vulnerabilidade facilmente explorável por atacante com baixo privilégio e acesso à rede via HTTPS para comprometer o Oracle Enterprise Command Center Framework. Embora a vulnerabilidade esteja no Oracle Enterprise Command Center Framework, ataques podem impactar significativamente produtos adicionais (mudança de escopo). Ataques bem-sucedidos podem resultar na tomada de controle do Oracle Enterprise Command Center Framework. Pontuação base CVSS 3.1 de 9.9 (impactos de confidencialidade, integridade e disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVE-2026-46899 Crítica · 9.6 CWE-269 17/06/2026

Oracle Enterprise Command Center Framework - Gerenciamento Impróprio de Privilégios (CVE-2026-46899)

Vulnerabilidade no produto Oracle Enterprise Command Center Framework do Oracle E-Business Suite (componente: Core). As versões suportadas afetadas são V15 e V16. Vulnerabilidade facilmente explorável que permite a um atacante com privilégios baixos e acesso à rede via HTTP comprometer o Oracle Enterprise Command Center Framework. Embora a vulnerabilidade esteja no Oracle Enterprise Command Center Framework, ataques podem impactar significativamente produtos adicionais (mudança de escopo). Ataques bem-sucedidos podem resultar em acesso não autorizado para criação, exclusão ou modificação de dados críticos ou de todos os dados acessíveis do Oracle Enterprise Command Center Framework, bem como acesso não autorizado a dados críticos ou acesso completo a todos os dados acessíveis do Oracle Enterprise Command Center Framework. CVSS 3.1 Base Score 9,6 (impactos de confidencialidade e integridade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).

CVE-2026-46895 Crítica · 9.9 CWE-269 17/06/2026

Oracle Enterprise Command Center Framework - Gerenciamento Impróprio de Privilégios

Vulnerabilidade no produto Oracle Enterprise Command Center Framework do Oracle E-Business Suite (componente: Core). As versões suportadas afetadas são V15 e V16. Vulnerabilidade facilmente explorável que permite a um atacante com baixo privilégio e acesso à rede via HTTP comprometer o Oracle Enterprise Command Center Framework. Embora a vulnerabilidade esteja no Oracle Enterprise Command Center Framework, ataques podem impactar significativamente produtos adicionais (mudança de escopo). Ataques bem-sucedidos podem resultar na tomada de controle do Oracle Enterprise Command Center Framework. CVSS 3.1 Base Score 9.9 (impactos de Confidencialidade, Integridade e Disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVE-2026-46893 Crítica · 9.9 CWE-269 17/06/2026

Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards ...

Vulnerability in the JD Edwards EnterpriseOne General Ledger product of Oracle JD Edwards (component: E1 Foundation). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via SMB to compromise JD Edwards EnterpriseOne General Ledger. While the vulnerability is in JD Edwards EnterpriseOne General Ledger, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne General Ledger. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVE-2026-46885 Alta · 8.8 CWE-269 17/06/2026

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). ...

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: EAI). Supported versions that are affected are 17.0-26.5. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in takeover of Siebel CRM Integration. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-46877 Média · 6.0 CWE-269 17/06/2026

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA...

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).

CVE-2026-46873 Alta · 7.5 CWE-269 17/06/2026

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA...

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).

CVE-2026-46867 Alta · 7.2 CWE-269 17/06/2026

Improper Privilege Management em Oracle Enterprise Manager Base Platform

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-46852 Crítica · 9.9 CWE-269 17/06/2026

Oracle Enterprise Manager Base Platform: gerenciamento impróprio de privilégios

Vulnerabilidade no produto Oracle Enterprise Manager Base Platform do Oracle Enterprise Manager (componente: Metadata Plugin). As versões suportadas afetadas são 13.5 e 24.1. Vulnerabilidade facilmente explorável permite a um atacante com baixo privilégio e acesso à rede via HTTPS comprometer o Oracle Enterprise Manager Base Platform. Embora a vulnerabilidade esteja no Oracle Enterprise Manager Base Platform, ataques podem impactar significativamente produtos adicionais (mudança de escopo). Ataques bem-sucedidos podem resultar na tomada de controle do Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.9 (impactos de Confidencialidade, Integridade e Disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVE-2026-46804 Alta · 8.7 CWE-269 17/06/2026

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component:...

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N).

CVE-2026-46794 Crítica · 9.9 CWE-269 17/06/2026

Oracle Identity Manager Connector: gerenciamento inadequado de privilégios

Vulnerabilidade no produto Identity Manager Connector do Oracle Fusion Middleware (componente: Generic Unix Connector). As versões suportadas afetadas são 12.2.1.4.0 e 14.1.2.1.0. Vulnerabilidade facilmente explorável permite que um atacante com privilégios baixos e acesso à rede via SSH comprometa o Identity Manager Connector. Embora a vulnerabilidade esteja no Identity Manager Connector, ataques podem impactar significativamente produtos adicionais (mudança de escopo). Ataques bem-sucedidos podem resultar na tomada de controle do Identity Manager Connector. CVSS 3.1 Base Score 9.9 (impactos de Confidencialidade, Integridade e Disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

CVE-2026-35291 Média · 6.6 CWE-269 17/06/2026

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). ...

Vulnerability in the WebLogic Server product of Oracle Fusion Middleware (component: Console). Supported versions that are affected are 14.1.2.0.0 and 15.1.1.0.0. Difficult to exploit vulnerability allows high privileged attacker with network access via HTTP to compromise WebLogic Server. Successful attacks of this vulnerability can result in takeover of WebLogic Server. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).

CVE-2026-35288 Alta · 8.2 CWE-269 17/06/2026

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component...

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where PeopleSoft Enterprise PT PeopleTools executes to compromise PeopleSoft Enterprise PT PeopleTools. While the vulnerability is in PeopleSoft Enterprise PT PeopleTools, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

CVE-2026-35272 Alta · 8.4 CWE-269 17/06/2026

Improper Privilege Management em Oracle Peoplesoft Enterprise Pt Peopletools

Vulnerability in the PeopleSoft Enterprise PT PeopleTools product of Oracle PeopleSoft (component: Deployment Package). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PT PeopleTools executes to compromise PeopleSoft Enterprise PT PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PT PeopleTools. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

CVE-2024-38487 Alta · 7.0 CWE-269 16/06/2026

Improper Privilege Management em Dell EMC VxRail Appliance

api-gateway container running with root privilege would allow an attacker to escape the container and access host system to perform unintended actions.

CVE-2026-12313 Média · 4.7 CWE-269 16/06/2026

Information disclosure, sandbox escape in the Security: Process Sandboxing component

Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

CVE-2026-12289 Alta · 8.8 CWE-269 16/06/2026

Privilege escalation in the Graphics: WebRender component

Privilege escalation in the Graphics: WebRender component. This vulnerability was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

CVE-2026-8176 Alta · 7.5 CWE-269 16/06/2026

LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1. The plugin chains three independent flaws that together allow an authenticated Agent (Agent+) to overwrite a WordPress Administrator's password without ever invoking an Administrator-only API. This makes it possible for authenticated attackers, with Agent access and above, to elevate their privileges to Administrator.

CVE-2025-9912 Média · 6.3 CWE-269 16/06/2026

A local privilege escalation vulnerability in Nokia SR Linux

Nokia SR Linux is vulnerable to a local privilege escalation vulnerability. Successful exploitation of this vulnerability may allow an authenticated user to execute arbitrary commands with superuser privilege.