Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with networ…

CVE-2026-34277MEDIUMCVSS 6.6EG 6.6

2026-04-21

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Fluid Core). Supported versions that are affected are 8.61-8.62. Easily exploitable vulnerability allows high privileged attacker with network…

CVE-2026-34283MEDIUMCVSS 6.1EG 6.1

2026-04-21

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Identity Console). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated a…

CVE-2026-34284MEDIUMCVSS 6.1EG 6.1

2026-04-21

Vulnerability in the Oracle Business Process Management Suite product of Oracle Fusion Middleware (component: Human workflow 11g+). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allo…

CVE-2026-34287CRITICALCVSS 9.1EG 9.1

2026-04-21

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with net…

CVE-2026-3429MEDIUMCVSS 4.2EG 4.2

2026-03-11

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtain…

CVE-2026-34291HIGHCVSS 8.7EG 8.7

2026-04-21

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with ne…

CVE-2026-34292HIGHCVSS 7.2EG 7.2

2026-04-21

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows high privileged attacker with …

CVE-2026-34294MEDIUMCVSS 5.9EG 5.9

2026-04-21

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Microsoft Active Directory). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privi…

CVE-2026-34295MEDIUMCVSS 6.5EG 6.5

2026-04-21

Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft (component: Purchasing). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network a…

CVE-2026-34298MEDIUMCVSS 4.7EG 4.7

2026-04-21

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). Supported versions that are affected are 12.2.9-12.2.15. Easily exploitable vulnerability allows high privileged attacker …

CVE-2026-34299MEDIUMCVSS 6.5EG 6.5

2026-04-21

Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged …

CVE-2026-34301MEDIUMCVSS 6.5EG 6.5

2026-04-21

Vulnerability in the PeopleSoft Enterprise FIN Maintenance Management product of Oracle PeopleSoft (component: Work Order Management). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged …

CVE-2026-34302MEDIUMCVSS 5.5EG 5.5

2026-04-21

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Loader). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network a…

CVE-2026-34306MEDIUMCVSS 6.5EG 6.5

2026-04-21

Vulnerability in the PeopleSoft Enterprise FIN Project Costing product of Oracle PeopleSoft (component: Projects). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with networ…

CVE-2026-34307MEDIUMCVSS 5.4EG 5.4

2026-04-21

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Workflow). Supported versions that are affected are 8.61-8.62. Easily exploitable vulnerability allows low privileged attacker with network ac…

CVE-2026-34309HIGHCVSS 8.1EG 8.1

2026-04-21

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.61-8.62. Easily exploitable vulnerability allows low privileged attacker with network ac…

CVE-2026-34310HIGHCVSS 7.5EG 7.5

2026-04-21

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Easily …

CVE-2026-34312LOWCVSS 2.4EG 2.4

2026-04-21

Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.30. Easily exploitable vulnerability allows high privileged attacker having Row Access Method privilege with network access v…

CVE-2026-34314MEDIUMCVSS 6.8EG 6.8

2026-04-21

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Difficu…

CVE-2026-34323MEDIUMCVSS 6.3EG 6.3

2026-04-21

Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: IDM Authentication). Supported versions that are affected are 7.0.1.0 and 7.0.1.1. Easily exploitable vulnerability allows unauthent…

CVE-2026-34324MEDIUMCVSS 6.5EG 6.5

2026-04-21

Vulnerability in the Oracle Life Sciences InForm product of Oracle Life Science Applications (component: App Server). Supported versions that are affected are 7.0.1.0 and 7.0.1.1. Easily exploitable vulnerability allows unauthenticated a…

CVE-2026-34325MEDIUMCVSS 6.8EG 6.8

2026-04-21

Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: User Interface). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. E…

CVE-2026-34358HIGHCVSS 8.1EG 8.1

2026-05-19

CtrlPanel is open-source billing software for hosting providers. Versions 1.1.1 and prior contains a broken access control vulnerability where multiple admin controllers enforce permission checks on form display methods but omit equivalent…

CVE-2026-34390MEDIUMCVSS 5.1EG 5.1

2026-05-19

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior have a Privilege Escalation vulnerability where insufficient access control checks in ProjectUsersAddCommand (manage_proj_user_add.php) allow users ha…

CVE-2026-34444CRITICALCVSS 10.0EG 10.0

2026-04-06

Lupa integrates the runtimes of Lua or LuaJIT2 into CPython. In 2.6 and earlier, attribute_filter is not consistently applied when attributes are accessed through built-in functions like getattr and setattr. This allows an attacker to bypa…

CVE-2026-34456CRITICALCVSS 9.1EG 9.1

2026-04-01

Reviactyl is an open-source game server management panel built using Laravel, React, FilamentPHP, Vite, and Go. From version 26.2.0-beta.1 to before version 26.2.0-beta.5, a vulnerability in the OAuth authentication flow allowed automatic …

CVE-2026-34570HIGHCVSS 8.8EG 8.8

2026-04-01

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when …

CVE-2026-34572HIGHCVSS 8.8EG 8.8

2026-04-01

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to immediately revoke active user sessions when …

CVE-2026-34723HIGHCVSS 7.5EG 7.5

2026-04-08

Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, unauthenticated remote attackers were able to access the getting started endpoint to get access to sensitive internal entity data, even after the…

CVE-2026-34754MEDIUMCVSS 4.3EG 4.3

2026-05-20

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Versions 2.28.1 and prior allow an authenticated user to upload attachments to private Issues they are not authorized to access. This issue has been fixed in version 2.28.2.

CVE-2026-34860MEDIUMCVSS 4.1EG 4.1

2026-04-13

Access control vulnerability in the memo module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

CVE-2026-34908CRITICALCVSS 10.0EG 10.0

2026-05-22

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

CVE-2026-35172HIGHCVSS 7.5EG 7.5

2026-04-06

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: tru…

CVE-2026-35185HIGHCVSS 7.5EG 7.5

2026-04-06

HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to 25.0.0, the /server-status endpoint is publicly accessible and exposes sensitive information including authentication tokens (user_token), user activity, client …

CVE-2026-35223CRITICALCVSS 9.8EG 9.8

2026-05-26

An improper access check allows unauthorized access to com_config webservice endpoints.

CVE-2026-35229HIGHCVSS 7.5EG 7.5

2026-04-21

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.30 and 21.3-21.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via Oracle Net to …

CVE-2026-35230HIGHCVSS 7.5EG 7.5

2026-04-21

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastru…

CVE-2026-35231HIGHCVSS 7.5EG 7.5

2026-04-21

Vulnerability in the Oracle Financial Services Transaction Filtering product of Oracle Financial Services Applications (component: User Interface). The supported version that is affected is 8.1.2.8.0. Easily exploitable vulnerability all…

CVE-2026-35232MEDIUMCVSS 5.4EG 5.4

2026-04-21

Vulnerability in Oracle Fusion Middleware (component: Dynamic Monitoring Service). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access vi…

CVE-2026-35234MEDIUMCVSS 4.9EG 4.9

2026-04-21

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). Supported versions that are affected are 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multi…

CVE-2026-35235MEDIUMCVSS 4.9EG 4.9

2026-04-21

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). Supported versions that are affected are 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple pr…

CVE-2026-35236MEDIUMCVSS 4.9EG 4.9

2026-04-21

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with netw…

CVE-2026-35237MEDIUMCVSS 4.9EG 4.9

2026-04-21

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with netw…

CVE-2026-35238MEDIUMCVSS 4.9EG 4.9

2026-04-21

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with netw…

CVE-2026-35239MEDIUMCVSS 4.9EG 4.9

2026-04-21

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacker with…

CVE-2026-35240MEDIUMCVSS 4.9EG 4.9

2026-04-21

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and 9.0.0-9.6.0. Easily exploitable vulnerability allows high privileged attacke…

CVE-2026-35241MEDIUMCVSS 5.7EG 5.7

2026-04-21

Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Research Tracking). The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker wit…

CVE-2026-35242HIGHCVSS 7.5EG 7.5

2026-04-21

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastru…

CVE-2026-35243HIGHCVSS 7.8EG 7.8

2026-04-21

Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle Fusion Middleware (component: ADF Faces). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows l…

CWE-284— Improper Access Control

CVEs classified under CWE-284page 81 of 86

Map vulnerabilities like CWE-284 to your infrastructure