These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
This debrief provides defensive context on CVE-2024-21182, an unspecified vulnerability in Oracle WebLogic Server. The CVE record was published on 2026-06-01 and has not been modified since then. Defenders should assess exposure and prioritize mitigations as the vulnerability has a HIGH severity score of 7.5 and may be exploited in the wild. The CISA Known Exploited Vulnerabilities catalog lists this vuln [truncated]
A medium-severity vulnerability in Oracle REST Data Services (ORDS) Core component affects versions 24.2.0 through 26.1.0. The vulnerability allows unauthenticated network attackers to cause partial denial of service via HTTPS. Published 2026-05-28 with CVSS 3.1 score 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). No known exploitation in the wild or ransomware campaign use. Oracle has issued a security alert [truncated]
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 contain an unauthenticated integrity vulnerability in the Core component. The flaw allows remote attackers with network access via HTTPS to perform unauthorized data modification operations (update, insert, or delete) without authentication. The vulnerability is rated CVSS 3.1 Base Score 5.3 (Medium severity) with a vector of CVSS:3.1/AV:N/AC [truncated]
A medium-severity information disclosure vulnerability in Oracle REST Data Services (ORDS) allows unauthenticated network attackers to read a subset of accessible data via HTTPS. Affected versions span 24.2.0 through 26.1.0. The vulnerability was disclosed by Oracle in its May 2026 Critical Patch Update. No known exploitation in ransomware campaigns has been reported.
A critical vulnerability in Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 allows low-privileged attackers with network access to achieve complete system takeover. The vulnerability, published May 28, 2026, carries a CVSS 3.1 score of 9.9 due to its network attack vector, low complexity, and scope change to additional products. Successful exploitation enables full confidentiality, integri [truncated]
A critical SQL injection vulnerability in Oracle Flow Manufacturing (Oracle E-Business Suite component: Security) allows low-privileged attackers with network access to achieve complete system takeover. Affected versions span 12.2.9 through 12.2.15. The vulnerability is rated CVSS 3.1 8.8 (High) with network attack vector, low attack complexity, and low privileges required—making it easily exploitable wit [truncated]
A vulnerability in the Net Service component of Oracle Database Server allows unauthenticated attackers with network access via TLS to cause a complete denial of service (DoS) through hangs or repeatable crashes. The vulnerability affects Oracle Database Server versions 23.4.0 through 23.26.2. The CVSS 3.1 base score of 7.5 reflects high availability impact with no confidentiality or integrity impact. The [truncated]
A high-severity vulnerability in Oracle Database Server's Net Service component allows unauthenticated remote attackers to cause a complete denial of service (DoS) via TLS. The vulnerability affects Oracle Database Server versions 23.4.0 through 23.26.2. With a CVSS 3.1 score of 7.5, this vulnerability is easily exploitable by network-based attackers without authentication, requiring no user interaction. [truncated]
A critical vulnerability in Oracle Database Server's Net Service component, affecting versions 23.4.0 through 23.26.2. The flaw allows unauthenticated network attackers to compromise Net Service via TLS, with potential scope change to impact additional products. Successful exploitation results in complete takeover of the affected service with confidentiality, integrity, and availability impacts. The attac [truncated]
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 contain an unauthenticated information disclosure vulnerability in the MongoAPI component. The flaw allows remote attackers with network access via HTTPS to obtain unauthorized read access to a subset of ORDS-accessible data without authentication. The vulnerability is rated CVSS 3.1 Base Score 5.3 (Medium severity) with a vector of CVSS:3.1/ [truncated]
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 contain an unauthenticated denial-of-service vulnerability in the Mongoapi component. The flaw allows remote attackers to cause complete service unavailability—either hangs or repeatable crashes—via HTTPS requests without authentication. The CVSS 3.1 score of 7.5 reflects high availability impact with low attack complexity and no required pri [truncated]
A high-severity vulnerability in Oracle E-Business Suite's Payroll component (Internal Operations) allows low-privileged attackers with network access to compromise Oracle Payroll via HTTP. The vulnerability, published on 2026-05-28, affects supported versions 12.2.3 through 12.2.15. Successful exploitation can result in unauthorized creation, deletion, or modification of critical data, as well as unautho [truncated]
A critical vulnerability in Oracle E-Business Suite's Payroll component (Self Service Manager) allows low-privileged attackers to achieve full application takeover via network access. Published 2026-05-28, this flaw affects versions 12.2.3 through 12.2.15 with a CVSS 3.1 score of 8.8. The vulnerability requires authenticated access but no user interaction, enabling remote compromise of confidentiality, in [truncated]
A critical vulnerability in Oracle E-Business Suite's Payroll component allows low-privileged attackers to achieve full system takeover via network access. Published May 28, 2026, this flaw affects versions 12.2.3 through 12.2.15 and carries a CVSS 3.1 score of 8.8. The vulnerability resides in the Internal Operations component of Oracle Payroll, where insufficient access controls enable authenticated att [truncated]
A critical vulnerability (CVSS 9.9) in Oracle Universal Work Queue, a component of Oracle E-Business Suite, was disclosed on May 28, 2026. The flaw resides in the Work Provider Site Level Administration component and affects versions 12.2.3 through 12.2.15. A low-privileged attacker with network access can exploit this vulnerability via HTTP to achieve complete takeover of Oracle Universal Work Queue. The [truncated]
A high-severity authorization vulnerability in Oracle Public Sector Financials (International) allows low-privileged attackers with network access to gain unauthorized access to critical data across Oracle E-Business Suite. The vulnerability affects versions 12.2.6 through 12.2.15 and carries a CVSS 3.1 score of 7.7. The scope change indicator (S:C) suggests successful exploitation may impact additional p [truncated]
A critical vulnerability in Oracle iAssets (Oracle E-Business Suite component: Internal Operations) allows low-privileged attackers with network access to achieve complete system takeover. The vulnerability affects versions 12.2.3 through 12.2.15 and carries a CVSS 3.1 score of 9.9 due to its network attack vector, low attack complexity, and scope change to additional products. Successful exploitation ena [truncated]
A high-severity confidentiality vulnerability in Oracle E-Business Suite Financials Common Modules allows low-privileged attackers with network access to gain unauthorized access to critical data across multiple products. The vulnerability affects versions 12.2.3 through 12.2.15 and was disclosed by Oracle in May 2026.
A high-severity vulnerability in Oracle E-Business Suite's Financials Common Modules allows low-privileged attackers with network access to compromise confidentiality and integrity of critical data across affected systems.
A critical unauthenticated remote code execution vulnerability in Oracle E-Business Suite's Internet Procurement Connector component allows network-based attackers to compromise confidentiality and integrity of all accessible data without authentication. The vulnerability affects versions 12.2.3 through 12.2.15 and carries a CVSS 3.1 base score of 9.1. Published by NVD on May 28, 2026, this vulnerability [truncated]
A high-severity vulnerability in Oracle E-Business Suite's Oracle Payments component (File Transmission) allows unauthenticated network attackers to compromise confidentiality and integrity of critical payment data. The vulnerability affects versions 12.2.3 through 12.2.15 and is rated CVSS 3.1 7.4 (High). While exploitation is rated as difficult (AC:H), successful attacks can result in unauthorized creat [truncated]
A critical vulnerability in Oracle REST Data Services (ORDS) allows low-privileged attackers with network access to achieve complete system takeover. The vulnerability affects versions 24.2.0 through 26.1.0 and carries a CVSS 3.1 score of 9.9 due to its network attack vector, low complexity, and scope change to additional products. Successful exploitation enables full confidentiality, integrity, and avail [truncated]
A high-severity vulnerability in Oracle REST Data Services (ORDS) Core component affects versions 24.2.0 through 26.1.0. Published 2026-05-28, this flaw allows low-privileged attackers with network access via HTTPS to compromise ORDS, potentially resulting in unauthorized creation, deletion, or modification of critical data as well as unauthorized access to all ORDS-accessible data. The CVSS 3.1 score of [truncated]
Oracle REST Data Services (ORDS) versions 24.2.0 through 26.1.0 contain a difficult-to-exploit vulnerability in the Core component. A low-privileged attacker with network access via HTTPS can compromise ORDS, with successful attacks requiring human interaction from a victim. The vulnerability has scope change characteristics, meaning attacks may significantly impact additional products beyond ORDS itself. [truncated]
A critical unauthenticated remote code execution vulnerability in Oracle Hospitality OPERA 5 Property Services allows network-based attackers to completely compromise affected hotel property management systems. The vulnerability affects versions 5.6.19.24, 5.6.22, 5.6.25.19, 5.6.27.6, and 5.6.28, with successful exploitation granting full system takeover with no authentication required.
A medium-severity vulnerability, CVE-2026-21999, was found in the XML Database component of Oracle Database Server. The vulnerability is difficult to exploit and allows an unauthenticated attacker with network access via HTTPS to compromise XML Database. Successful attacks require human interaction and can result in unauthorized access to critical data or complete access to all XML Database accessible dat [truncated]
CVE-2024-21262 is a network-reachable vulnerability published on 2024-10-15 with a CVSS 3.1 base score of 6.5. The supplied record describes an unauthenticated attacker with network access as able to affect MySQL Connectors data and cause a partial denial of service. The source corpus also shows NVD affected-CPE mapping for both Oracle MySQL Connectors (up to 9.0.0) and NetApp OnCommand Insight, so versio [truncated]
