CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.11.06)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Vulnerability in Oracle Communications Pricing Design Center (component: On-premise Deployment). A low-privileged attacker with local access can gain unauthorized access to critical data and modify some data. The attack may affect other products. CVSS 7.3.
Vulnerability in Oracle Enterprise Manager Base Platform (Self Update Framework component) allows a high-privileged attacker via HTTPS to take over the platform.
Vulnerability in Oracle Enterprise Manager Base Platform (Self Update Framework component) allows a high-privileged attacker via HTTPS to take over the platform.
Vulnerability in Oracle Enterprise Manager Base Platform (component: Self Update Framework) allows a low-privileged attacker with network access via HTTPS to compromise the system. No user interaction is required.
Vulnerability in Oracle Enterprise Manager Base Platform (Discovery Framework component) allows an unauthenticated attacker with network access via HTTPS to modify critical data, partially read data, and cause partial denial of service. The attack is difficult to exploit.
Vulnerability in Oracle Enterprise Manager Base Platform (component: Metadata Plugin). An unauthenticated attacker with network access via HTTPS can take over the platform, but requires user interaction.
Vulnerability in Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager, component Metadata Plugin. Affects versions 13.5 and 24.1. A low-privileged attacker with network access via HTTPS can gain unauthorized access to create, delete, or modify critical data and read a subset of data.
Vulnerability in Oracle Enterprise Manager Base Platform (component: Metadata Plugin) allows a low-privileged attacker with network access via HTTPS to compromise the system. No user interaction is required.
Difficult to exploit vulnerability in Oracle Enterprise Manager Base Platform (Agent Next Gen) versions 13.5 and 24.1. A low-privileged attacker via HTTPS can gain unauthorized access to critical data and the ability to create, delete, or modify it, also affecting other products.
Vulnerability in Oracle Enterprise Manager Base Platform (Enterprise Config Management component) allows a low-privileged attacker with network access via HTTPS to take over the platform. The attack is easily exploitable.
Vulnerability in Oracle Enterprise Manager Base Platform (Enterprise Config Management component) allows an unauthenticated attacker via HTTP to modify, read, and partially disrupt the system.
Vulnerability in Oracle Enterprise Manager Base Platform (Connector Framework component) allows a high-privileged attacker via HTTPS to take over the platform.
Vulnerability in Oracle Enterprise Manager Base Platform (component: Application Service Level Mgmt). Affects versions 13.5 and 24.1. A low-privileged attacker with network access via HTTPS can gain unauthorized access to critical data, with potential impact on additional products (scope change).
Vulnerability in Oracle Utilities Network Management System (component: Mobile) in multiple versions. Easily exploitable, allows an unauthenticated attacker via HTTP to unauthorized update, insert, delete, or read part of the data. May affect other products (scope change).
Vulnerability in Oracle Human Resources (component: Data Removal Tool) versions 12.2.3-12.2.15. Allows a high-privileged attacker with network access via HTTP to take over the system.
Vulnerability in Oracle Retail EFTLink product (Core/Plugin component), versions 21.0.0-25.0.0. A difficult-to-exploit flaw allows an unauthenticated attacker with network access via HTTPS to compromise data confidentiality and integrity, including critical data.
Vulnerability in Oracle Cost Management product (Cost Maintenance component), versions 12.2.3-12.2.15. A difficult-to-exploit flaw allows a low-privileged attacker with network access via HTTP to take over the system.
Difficult to exploit vulnerability in Oracle Public Sector Financials (International) (part of Oracle E-Business Suite) versions 12.2.3-12.2.15. A high-privileged attacker via HTTP can take over the system, also affecting other products.
FUXA version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization by script ID, but when test: true is set, it compiles and executes attacker-supplied code instead of the stored script. An unauthenticated attacker who knows a valid script ID and name can execute arbitrary code.
FUXA version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allowing unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS