Security News

Critical vulnerabilities, as they're published

We track newly-disclosed CVEs in CMS platforms, plugins, and e-commerce software — WordPress, Magento, WooCommerce and more — so you know when something could affect your website.

CRITICAL 9.1 CVE-2026-70978 18 Aug 2026

Oracle Commerce Guided Search and Experience Manager Unauthorized Data Access Flaw

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Guided Search / Oracle Commerce Experience Manager. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modi

CRITICAL 9.1 CVE-2026-70977 18 Aug 2026

Oracle Commerce Guided Search and Experience Manager Flaw Enables Data Tampering and DoS

CRITICAL 9.1 CVE-2026-70976 18 Aug 2026

Oracle Commerce Guided Search Flaw Enables Data Tampering and DoS

CRITICAL 9.8 CVE-2026-70970 18 Aug 2026

Oracle WebCenter Portal Runtime Tools Unauthenticated Takeover Vulnerability

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impact

CRITICAL 9.8 CVE-2026-70954 18 Aug 2026

Oracle Commerce Platform Unauthenticated Takeover Vulnerability

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS

CRITICAL 9.8 CVE-2026-70953 18 Aug 2026

Oracle Commerce Platform Remote Takeover Vulnerability

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework). The supported version that is affected is 11.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Commerce Platform. Successful attacks of this vulnerability can result in takeover of Oracle Commerce Platform. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS

CRITICAL 9.3 CVE-2026-70855 18 Aug 2026

Oracle Siebel Self Service Vulnerability Enables Unauthorized Data Access

Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component: Helpdesk/Training). Supported versions that are affected are 17.0-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Self Service. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Siebel Apps - Self Service, attacks may significantly impact add

CRITICAL 9.0 CVE-2026-62988 18 Aug 2026

Froxlor API Information Disclosure Vulnerability

Froxlor is open source server administration software. From 2.3.7 until 2.3.8, the Customers.get, Customers.listing, Admins.get, Admins.listing, Ftps.get, and Ftps.listing API commands in lib/Froxlor/Api/Commands/Customers.php, lib/Froxlor/Api/Commands/Admins.php, and lib/Froxlor/Api/Commands/Ftps.php retrieve full database rows and return them without removing password and data_2fa fields. An authenticated API caller with permission to use these endpoints can obtain customer

CRITICAL 9.8 CVE-2026-61318 18 Aug 2026

Oracle Siebel CRM Cloud Manager Unauthenticated Takeover Vulnerability

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impac

CRITICAL 9.1 CVE-2026-61034 18 Aug 2026

Oracle WebCenter Sites HTTP Vulnerability Leads to Takeover

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability ca

CRITICAL 9.0 CVE-2026-61029 18 Aug 2026

Oracle WebCenter Sites Unauthenticated Takeover Vulnerability

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability

CRITICAL 9.9 CVE-2026-61021 18 Aug 2026

Oracle WebCenter Sites Remote Takeover Vulnerability

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. While the vulnerability is in Oracle WebCenter Sites, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can

CRITICAL 9.8 CVE-2026-61018 18 Aug 2026

Oracle WebCenter Sites Unauthenticated Takeover Vulnerability

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts

CRITICAL 9.1 CVE-2026-61008 18 Aug 2026

Oracle WebCenter Sites Flaw Allows Unauthenticated Data Access and Modification

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Sites accessibl

CRITICAL 9.6 CVE-2026-60905 18 Aug 2026

Oracle WebCenter Content Critical HTTP Vulnerability

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significa

CRITICAL 9.9 CVE-2026-60730 18 Aug 2026

Oracle WebCenter Portal Composer Takeover Vulnerability

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can res

CRITICAL 9.1 CVE-2026-60728 18 Aug 2026

Oracle WebCenter Portal Portlet Services Unauthorized Data Access and DoS Vulnerability

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Portal. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Portal accessible data and u

CRITICAL 9.3 CVE-2026-67921 18 Aug 2026

Halo CMS CSRF Vulnerability Allows Arbitrary Code Execution

Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components. This allows a remote attacker to execute arbitrary code.

CRITICAL 9.1 CVE-2026-52610 18 Aug 2026

Reportico Web Directory Traversal Arbitrary File Write Vulnerability

An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or overwrite files anywhere on the filesystem subject to the permissions of the web user by specifying a filename in the "saveTemplate" parameter in conjuction with "execute_mode=PREPARE" parameter in the "run.php" endpoint.

CRITICAL 9.8 CVE-2026-52608 18 Aug 2026

Reportico Web Incorrect Access Control Leads to RCE

An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the safe_mode setting leading to remote code execution.

Page 43 of 46 (904 total)

Think your server has been compromised?

Tell us what happened. We'll review your request and provide an initial response within 1 hour.

Get Emergency Help help@myserverhacked.com