Vulnerabilidades de Oracle
CVEs publicadas que afetam produtos de Oracle: 4614 registro(s), com severidade, exploração e correções.
Mysql Server 192Peoplesoft Enterprise Peopletools 173Hyperion Financial Management 163Jd Edwards Enterpriseone Tools 144Helidon 138E-business Suite 133Mysql Cluster 130Webcenter Content 128WebCenter Portal 128Coherence 118Weblogic Server 112Vm Virtualbox 108Commerce Guided Search 106Oracle Commerce Guided Search / Oracle Commerce Experience Manager 105Jre 92Java Se 92Jdk 87Hyperion Infrastructure Technology 77Siebel Crm 75Commerce Experience Manager 75Enterprise Manager Base Platform 74Siebel CRM Deployment 73Agile Product Lifecycle Management 68Business Intelligence Enterprise Edition 66Retail Xstore Point Of Service 62Siebel CRM Cloud Applications 61Communications Cloud Native Core Policy 59Oracle GraalVM Enterprise Edition 59Webcenter Sites 58Graalvm For Jdk 58Solaris 57Hyperion Data Relationship Management 56Communications Unified Inventory Management 56Database Server 51Essbase 50Zfs Storage Appliance Kit 49Access Manager 47Outside In Technology 46Identity Manager Connector 45Rest Data Services 45
CVE-2026-46879
Crítica · 9.8
CWE-306 17/06/2026
Oracle JD Edwards EnterpriseOne Tools - Falta de autenticação (CWE-306)
Vulnerabilidade no produto EnterpriseOne Tools do JD Edwards da Oracle (componente: Enterprise Infrastructure Security). As versões suportadas afetadas são 9.2.0.0-9.2.26.2. Vulnerabilidade facilmente explorável permite a um atacante não autenticado com acesso à rede via JDENET comprometer o JD Edwards EnterpriseOne Tools. Ataques bem-sucedidos desta vulnerabilidade podem resultar na tomada de controle do JD Edwards EnterpriseOne Tools. CVSS 3.1 Base Score 9.8 (impactos de Confidencialidade, Integridade e Disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-46878
Crítica · 9.8
CWE-284 17/06/2026
Vulnerabilidade de controle de acesso inadequado no Oracle JD Edwards EnterpriseOne Tools (CVE-2026-46878)
Vulnerabilidade no produto JD Edwards EnterpriseOne Tools da Oracle JD Edwards (componente: Enterprise Infrastructure Security). As versões suportadas afetadas são 9.2.0.0-9.2.26.2. Vulnerabilidade facilmente explorável permite que um atacante não autenticado com acesso à rede via JDENET comprometa o JD Edwards EnterpriseOne Tools. Ataques bem-sucedidos podem resultar na tomada de controle do JD Edwards EnterpriseOne Tools. Pontuação base CVSS 3.1 de 9.8 (impactos de confidencialidade, integridade e disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-46877
Média · 6.0
CWE-269 17/06/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA...
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 6.0 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N).
CVE-2026-46875
Crítica · 9.1
CWE-284 17/06/2026
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager...
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Deployment Library). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-46874
Baixa · 3.2
CWE-200 17/06/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). ...
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.8. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized read access to a subset of Oracle VM VirtualBox accessible data. CVSS 3.1 Base Score 3.2 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N).
CVE-2026-46873
Alta · 7.5
CWE-269 17/06/2026
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA...
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: VMSVGA device). The supported version that is affected is 7.2.8. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-46872
Crítica · 9.0
CWE-284 17/06/2026
Oracle Enterprise Manager Base Platform - Controle de acesso inadequado
Vulnerabilidade no produto Oracle Enterprise Manager Base Platform do Oracle Enterprise Manager (componente: Install). As versões suportadas afetadas são 13.5 e 24.1. Vulnerabilidade facilmente explorável que permite a um atacante com privilégios altos e acesso à rede via HTTPS comprometer o Oracle Enterprise Manager Base Platform. Embora a vulnerabilidade esteja no Oracle Enterprise Manager Base Platform, ataques podem impactar significativamente produtos adicionais (mudança de escopo). Ataques bem-sucedidos podem resultar em acesso não autorizado de criação, exclusão ou modificação de dados críticos ou de todos os dados acessíveis ao Oracle Enterprise Manager Base Platform, bem como em acesso de leitura não autorizado a um subconjunto dos dados acessíveis ao Oracle Enterprise Manager Base Platform e na capacidade não autorizada de causar travamento ou falha frequentemente repetível (DoS completo) do Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.0 (impactos de confidencialidade, integridade e disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:H).
CVE-2026-46871
Média · 6.5
CWE-284 17/06/2026
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The...
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The supported version that is affected is 2026.2.0+9.6.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Shell. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Shell accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
CVE-2026-46870
Alta · 8.5
CWE-284 17/06/2026
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The...
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell for VS Code). The supported version that is affected is 2026.2.0+9.6.1. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Shell. While the vulnerability is in MySQL Shell, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of MySQL Shell. CVSS 3.1 Base Score 8.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-46869
Média · 6.5
CWE-352 17/06/2026
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Dump and Load). ...
Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Dump and Load). Supported versions that are affected are 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Shell. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Shell accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
CVE-2026-46868
Alta · 7.2
CWE-284 17/06/2026
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager...
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-46867
Alta · 7.2
CWE-269 17/06/2026
Improper Privilege Management em Oracle Enterprise Manager Base Platform
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-46866
Alta · 8.2
CWE-400 17/06/2026
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager...
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Enterprise Manager Base Platform as well as unauthorized update, insert or delete access to some of Oracle Enterprise Manager Base Platform accessible data. CVSS 3.1 Base Score 8.2 (Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).
CVE-2026-46865
Alta · 8.2
CWE-284 17/06/2026
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager...
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Extensibility Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Enterprise Manager Base Platform executes to compromise Oracle Enterprise Manager Base Platform. While the vulnerability is in Oracle Enterprise Manager Base Platform, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-46864
Alta · 8.8
CWE-284 17/06/2026
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager...
Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows low privileged attacker with network access via SSH to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-46863
Alta · 7.5
CWE-400 17/06/2026
Uncontrolled Resource Consumption em Oracle Mysql Cluster
Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are MySQL Server: 8.4.0-8.4.9, 9.0.0-9.7.0; MySQL Cluster: 8.0.11-8.0.46, 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-46862
Alta · 7.5
CWE-400 17/06/2026
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). ...
Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General). Supported versions that are affected are 8.4.0-8.4.9 and 9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Router. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
CVE-2026-46861
Crítica · 9.6
CWE-284 17/06/2026
Controle de acesso inadequado no Oracle MySQL NDB Cluster (CVE-2026-46861)
Vulnerabilidade no produto MySQL NDB Cluster do Oracle MySQL (componente: Cluster: NDB Operator). As versões suportadas afetadas são 8.0.11-8.0.46, 8.4.0-8.4.9 e 9.0.0-9.7.0. Vulnerabilidade facilmente explorável que permite a um atacante com baixo privilégio e acesso à rede via HTTP comprometer o MySQL NDB Cluster. Embora a vulnerabilidade esteja no MySQL NDB Cluster, ataques podem impactar significativamente produtos adicionais (mudança de escopo). Ataques bem-sucedidos podem resultar em acesso não autorizado para criação, exclusão ou modificação de dados críticos ou de todos os dados acessíveis do MySQL NDB Cluster, bem como em acesso não autorizado a dados críticos ou acesso completo a todos os dados acessíveis do MySQL NDB Cluster. Pontuação base CVSS 3.1 de 9.6 (impactos de confidencialidade e integridade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N).
CVE-2026-46860
Crítica · 9.8
CWE-284 17/06/2026
Vulnerabilidade de controle de acesso inadequado no Oracle MySQL Router (CVE-2026-46860)
Vulnerabilidade no produto MySQL Router da Oracle MySQL (componente: Router: General). As versões suportadas afetadas são 9.0.0-9.7.0. Uma vulnerabilidade facilmente explorável permite que um atacante não autenticado com acesso à rede via HTTP comprometa o MySQL Router. Ataques bem-sucedidos podem resultar na tomada de controle do MySQL Router. CVSS 3.1 Base Score 9.8 (impactos de Confidencialidade, Integridade e Disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-46859
Crítica · 9.8
CWE-287 17/06/2026
Vulnerabilidade de autenticação indevida no Oracle Agile PLM (CVE-2026-46859)
Vulnerabilidade no produto Oracle Agile Product Lifecycle Management do Oracle Supply Chain (componente: Security). A versão suportada afetada é 9.3.6. Vulnerabilidade facilmente explorável permite que um atacante não autenticado com acesso à rede via HTTP comprometa o Oracle Agile PLM. Ataques bem-sucedidos desta vulnerabilidade podem resultar na tomada de controle do Oracle Agile PLM. CVSS 3.1 Base Score 9.8 (impactos de Confidencialidade, Integridade e Disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-46858
Crítica · 9.1
CWE-284 17/06/2026
Oracle APM JVM Diagnostics: controle de acesso inadequado
Vulnerabilidade no produto APM - Application Performance Management do Oracle Enterprise Manager (componente: JADM, JVM Diagnostics). As versões suportadas afetadas são 13.5 e 24.1. Vulnerabilidade facilmente explorável permite que um atacante não autenticado com acesso à rede via HTTP comprometa o APM - Application Performance Management. Ataques bem-sucedidos podem resultar em acesso não autorizado para criar, excluir ou modificar dados críticos ou todos os dados acessíveis do APM - Application Performance Management, e em capacidade não autorizada de causar travamento ou falha frequentemente repetível (negação de serviço completa) do APM - Application Performance Management. CVSS 3.1 Base Score 9.1 (impactos de Integridade e Disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H).
CVE-2026-46857
Crítica · 9.8
CWE-284 17/06/2026
Oracle Enterprise Manager Base Platform - controle de acesso inadequado
Vulnerabilidade no produto Oracle Enterprise Manager Base Platform do Oracle Enterprise Manager (componente: Oracle Management Service). As versões suportadas afetadas são 13.5 e 24.1. Vulnerabilidade facilmente explorável permite que um atacante não autenticado com acesso à rede via HTTP comprometa o Oracle Enterprise Manager Base Platform. Ataques bem-sucedidos podem resultar na tomada de controle do Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.8 (impactos de Confidencialidade, Integridade e Disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
CVE-2026-46856
Crítica · 9.6
CWE-79 17/06/2026
Oracle Enterprise Manager Base Platform: falha de cross-site scripting no Metadata Plugin (CWE-79)
Vulnerabilidade no produto Oracle Enterprise Manager Base Platform do Oracle Enterprise Manager (componente: Metadata Plugin). As versões suportadas afetadas são 13.5 e 24.1. Vulnerabilidade facilmente explorável permite que um atacante não autenticado com acesso à rede via HTTP comprometa o Oracle Enterprise Manager Base Platform. Ataques bem-sucedidos exigem interação humana de uma pessoa diferente do atacante e, embora a vulnerabilidade esteja no Oracle Enterprise Manager Base Platform, ataques podem impactar significativamente produtos adicionais (mudança de escopo). Ataques bem-sucedidos podem resultar na tomada de controle do Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.6 (impactos de Confidencialidade, Integridade e Disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
CVE-2026-46855
Crítica · 9.9
CWE-284 17/06/2026
Oracle Enterprise Manager Base Platform - Controle de Acesso Inadequado
Vulnerabilidade no produto Oracle Enterprise Manager Base Platform do Oracle Enterprise Manager (componente: Metadata Plugin). As versões suportadas afetadas são 13.5 e 24.1. Vulnerabilidade facilmente explorável permite que um atacante com baixo privilégio e acesso à rede via HTTPS comprometa o Oracle Enterprise Manager Base Platform. Embora a vulnerabilidade esteja no Oracle Enterprise Manager Base Platform, ataques podem impactar significativamente produtos adicionais (mudança de escopo). Ataques bem-sucedidos dessa vulnerabilidade podem resultar na tomada de controle do Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.9 (impactos de Confidencialidade, Integridade e Disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
CVE-2026-46854
Crítica · 9.9
CWE-284 17/06/2026
Vulnerabilidade de controle de acesso inadequado no Oracle Enterprise Manager Base Platform (CVE-2026-46854)
Vulnerabilidade no produto Oracle Enterprise Manager Base Platform do Oracle Enterprise Manager (componente: Target Management). As versões suportadas afetadas são 13.5 e 24.1. Vulnerabilidade facilmente explorável permite que um atacante com baixo privilégio e acesso à rede via HTTP comprometa o Oracle Enterprise Manager Base Platform. Embora a vulnerabilidade esteja no Oracle Enterprise Manager Base Platform, ataques podem impactar significativamente produtos adicionais (mudança de escopo). Ataques bem-sucedidos podem resultar na tomada do Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 9.9 (impactos de Confidencialidade, Integridade e Disponibilidade). Vetor CVSS: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).