Vulnerabilities and patches across Oracle's enterprise stack — E-Business Suite (including Payments), Fusion Middleware, WebLogic Server, Database, and Java — driven by the January, April, July, and October Critical Patch Update cycle. Combined article + CVE feed for the Oracle beat.https://0daynews.com/en-ushttps://0daynews.com/cve/cve-2008-3431/https://0daynews.com/cve/cve-2008-3431/An input validation vulnerability exists in the VBoxDrv.sys driver of Sun xVM VirtualBox which allows attackers to locally execute arbitrary code.Thu, 03 Sep 2026 00:00:00 GMTOraclehighcvehttps://0daynews.com/cve/cve-2010-0840/https://0daynews.com/cve/cve-2010-0840/Unspecified vulnerability in the Java Runtime Environment (JRE) in Java SE component allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2011-3544/https://0daynews.com/cve/cve-2011-3544/An access control vulnerability exists in the Applet Rhino Script Engine component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2012-0507/https://0daynews.com/cve/cve-2012-0507/An incorrect type vulnerability exists in the Concurrency component of Oracle's Java Runtime Environment allows an attacker to remotely execute arbitrary code.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2012-0518/https://0daynews.com/cve/cve-2012-0518/Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware allows remote attackers to affect integrity via Unknown vectorsThu, 03 Sep 2026 00:00:00 GMTOraclemediumcvehttps://0daynews.com/cve/cve-2012-1710/https://0daynews.com/cve/cve-2012-1710/Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Designer.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2012-1723/https://0daynews.com/cve/cve-2012-1723/Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to Hotspot.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2012-3152/https://0daynews.com/cve/cve-2012-3152/Oracle Fusion Middleware Reports Developer contains an unspecified vulnerability that allows remote attackers to affect confidentiality and integrity of affected systems.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2012-4681/https://0daynews.com/cve/cve-2012-4681/The Java Runtime Environment (JRE) component in Oracle Java SE allow for remote code execution.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2012-5076/https://0daynews.com/cve/cve-2012-5076/The default Java security properties configuration did not restrict access to the com.sun.org.glassfish.external and com.sun.org.glassfish.gmbal packages. An untrusted Java application or applet could use these flaws to bypass Java sandbox restrictions.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2013-0422/https://0daynews.com/cve/cve-2013-0422/A vulnerability in the way Java restricts the permissions of Java applets could allow an attacker to execute commands on a vulnerable system.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2013-0431/https://0daynews.com/cve/cve-2013-0431/Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle allows remote attackers to bypass the Java security sandbox.Thu, 03 Sep 2026 00:00:00 GMTOraclemediumcvehttps://0daynews.com/cve/cve-2013-2423/https://0daynews.com/cve/cve-2013-2423/Unspecified vulnerability in hotspot for Java Runtime Environment (JRE) allows remote attackers to affect integrity.Thu, 03 Sep 2026 00:00:00 GMTOraclelowcvehttps://0daynews.com/cve/cve-2013-2465/https://0daynews.com/cve/cve-2013-2465/Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE allows remote attackers to affect confidentiality, integrity, and availability via Unknown vectors related to 2DThu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2015-2590/https://0daynews.com/cve/cve-2015-2590/An unspecified vulnerability exists within Oracle Java Runtime Environment that allows an attacker to perform remote code execution.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2015-4852/https://0daynews.com/cve/cve-2015-4852/Oracle WebLogic Server contains a deserialization of untrusted data vulnerability within Apache Commons, which can allow for for remote code execution.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2015-4902/https://0daynews.com/cve/cve-2015-4902/Unspecified vulnerability in Oracle Java SE allows remote attackers to affect integrity via Unknown vectors related to deployment.Thu, 03 Sep 2026 00:00:00 GMTOraclemediumcvehttps://0daynews.com/cve/cve-2016-3427/https://0daynews.com/cve/cve-2016-3427/Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX). This vulnerability can be exploited through sandboxed Java Web Start applications and sandboxed Java applets. It can also be exploited by supplying data to APIs in the specified component without using sandboxed Java Web Start applications or sandboxed Java applets, such as through a web service.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2017-10271/https://0daynews.com/cve/cve-2017-10271/Oracle Corporation WebLogic Server contains a vulnerability that allows for remote code execution.Thu, 03 Sep 2026 00:00:00 GMTOraclehighcvehttps://0daynews.com/cve/cve-2017-3506/https://0daynews.com/cve/cve-2017-3506/Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document.Thu, 03 Sep 2026 00:00:00 GMTOraclehighcvehttps://0daynews.com/cve/cve-2018-2628/https://0daynews.com/cve/cve-2018-2628/Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2019-2616/https://0daynews.com/cve/cve-2019-2616/Oracle BI Publisher, formerly XML Publisher, contains an unspecified vulnerability that allows for various unauthorized actions. Open-source reporting attributes this vulnerability to allowing for authentication bypass.Thu, 03 Sep 2026 00:00:00 GMTOraclehighcvehttps://0daynews.com/cve/cve-2019-2725/https://0daynews.com/cve/cve-2019-2725/Injection vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services).Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2019-3010/https://0daynews.com/cve/cve-2019-3010/Oracle Solaris component: XScreenSaver contains an unspecified vulnerability that allows for privilege escalation.Thu, 03 Sep 2026 00:00:00 GMTOraclehighcvehttps://0daynews.com/cve/cve-2020-14644/https://0daynews.com/cve/cve-2020-14644/Oracle WebLogic Server, a product within the Fusion Middleware suite, contains a deserialization vulnerability. Unauthenticated attackers with network access via T3 or IIOP can exploit this vulnerability to achieve remote code execution.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2020-14750/https://0daynews.com/cve/cve-2020-14750/Oracle WebLogic Server contains an unspecified vulnerability allowing an unauthenticated attacker to perform remote code execution. This vulnerability is related to CVE-2020-14882.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2020-14864/https://0daynews.com/cve/cve-2020-14864/Path traversal vulnerability, where an attacker can target the preview FilePath parameter of the getPreviewImage function to get access to arbitrary system file.Thu, 03 Sep 2026 00:00:00 GMTOraclehighcvehttps://0daynews.com/cve/cve-2020-14871/https://0daynews.com/cve/cve-2020-14871/Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2020-14882/https://0daynews.com/cve/cve-2020-14882/Oracle WebLogic Server contains an unspecified vulnerability, which is assessed to allow for remote code execution, based on this vulnerability being related to CVE-2020-14750.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2020-14883/https://0daynews.com/cve/cve-2020-14883/Oracle WebLogic Server contains an unspecified vulnerability in the Console component with high impacts to confidentilaity, integrity, and availability.Thu, 03 Sep 2026 00:00:00 GMTOraclehighcvehttps://0daynews.com/cve/cve-2020-2551/https://0daynews.com/cve/cve-2020-2551/Oracle Fusion Middleware contains an unspecified vulnerability in the WLS Core Components that allows an unauthenticated attacker with network access via IIOP to compromise the WebLogic Server.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2020-2555/https://0daynews.com/cve/cve-2020-2555/Multiple Oracle products contain a remote code execution vulnerability that allows an unauthenticated attacker with network access via T3 or HTTP to takeover the affected system. Impacted Oracle products: Oracle Coherence in Fusion Middleware, Oracle Utilities Framework, Oracle Retail Assortment Planning, Oracle Commerce, Oracle Communications Diameter Signaling Router (DSR).Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2020-2883/https://0daynews.com/cve/cve-2020-2883/Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an unspecified vulnerability exploitable by an unauthenticated attacker with network access via IIOP or T3.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2021-35587/https://0daynews.com/cve/cve-2021-35587/Oracle Fusion Middleware Access Manager allows an unauthenticated attacker with network access via HTTP to takeover the Access Manager product.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2022-21445/https://0daynews.com/cve/cve-2022-21445/Oracle ADF Faces library, included with Oracle JDeveloper Distribution, contains a deserialization of untrusted data vulnerability leading to unauthenticated remote code execution.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2022-21587/https://0daynews.com/cve/cve-2022-21587/Oracle E-Business Suite contains an unspecified vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Web Applications Desktop Integrator.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2023-21839/https://0daynews.com/cve/cve-2023-21839/Oracle WebLogic Server contains an unspecified vulnerability that allows an unauthenticated attacker with network access via T3, IIOP, to compromise Oracle WebLogic Server.Thu, 03 Sep 2026 00:00:00 GMTOraclehighcvehttps://0daynews.com/cve/cve-2024-20953/https://0daynews.com/cve/cve-2024-20953/Oracle Agile Product Lifecycle Management (PLM) contains a deserialization vulnerability that allows a low-privileged attacker with network access via HTTP to compromise the system.Thu, 03 Sep 2026 00:00:00 GMTOraclehighcvehttps://0daynews.com/cve/cve-2024-21182/https://0daynews.com/cve/cve-2024-21182/Oracle WebLogic contains an unspecified vulnerability that could allow an unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data.Thu, 03 Sep 2026 00:00:00 GMTOraclehighcvehttps://0daynews.com/cve/cve-2024-21287/https://0daynews.com/cve/cve-2024-21287/Oracle Agile Product Lifecycle Management (PLM) contains an incorrect authorization vulnerability in the Process Extension component of the Software Development Kit. Successful exploitation of this vulnerability may result in unauthenticated file disclosure.Thu, 03 Sep 2026 00:00:00 GMTOraclehighcvehttps://0daynews.com/cve/cve-2025-61757/https://0daynews.com/cve/cve-2025-61757/Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2025-61882/https://0daynews.com/cve/cve-2025-61882/A critical authentication-bypass and remote-code-execution flaw in the BI Publisher Integration component of Oracle E-Business Suite (versions 12.2.3–12.2.14). Exploited in the wild by Cl0p since August 2025; linked to the Estée Lauder HR-system breach disclosed July 20, 2026.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2025-61884/https://0daynews.com/cve/cve-2025-61884/Oracle E-Business Suite contains a server-side request forgery (SSRF) vulnerability in the Runtime component of Oracle Configurator. This vulnerability is remotely exploitable without authentication.Thu, 03 Sep 2026 00:00:00 GMTOraclehighcvehttps://0daynews.com/cve/cve-2026-21962/https://0daynews.com/cve/cve-2026-21962/Unauthenticated HTTP access exposes critical data on Oracle HTTP Server and WebLogic Server. CVSS 10.0. CISA added to KEV August 25, 2026; active exploitation confirmed.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2026-35273/https://0daynews.com/cve/cve-2026-35273/Oracle PeopleSoft Enterprise PeopleTools contains a missing authentication for critical function vulnerability which could allow an unauthenticated attacker to obtain takeover of PeopleSoft Enterprise PeopleTools.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/cve/cve-2026-46817/https://0daynews.com/cve/cve-2026-46817/A critical improper-privilege-management flaw in the Oracle Payments component of Oracle E-Business Suite (File Transmission) that lets an unauthenticated network attacker take over Oracle Payments. Patched in Oracle's May 2026 Critical Patch Update; added to CISA KEV on July 15, 2026.Thu, 03 Sep 2026 00:00:00 GMTOraclecriticalcvehttps://0daynews.com/articles/2026-08-25-oracle-weblogic-cve-2026-21962-kev/https://0daynews.com/articles/2026-08-25-oracle-weblogic-cve-2026-21962-kev/CISA added CVE-2026-21962 to KEV on August 25. CVSS 10.0. Unauthenticated HTTP access to Oracle WebLogic and HTTP Server. Active exploitation confirmed.Tue, 25 Aug 2026 12:30:00 GMTOraclearticlehttps://0daynews.com/articles/2026-07-21-estee-lauder-cl0p-oracle-ebs-cve-2025-61882-bi-publisher-11-month-dwell/https://0daynews.com/articles/2026-07-21-estee-lauder-cl0p-oracle-ebs-cve-2025-61882-bi-publisher-11-month-dwell/Estée Lauder's July 20 letter says Cl0p breached its Oracle E-Business Suite HR system on August 9, 2025 via CVE-2025-61882. Dwell: 11 months.Tue, 21 Jul 2026 00:20:00 GMTOraclearticlehttps://0daynews.com/articles/2026-07-15-cisa-kev-oracle-ebs-cve-2026-46817-payments-file-transmission/https://0daynews.com/articles/2026-07-15-cisa-kev-oracle-ebs-cve-2026-46817-payments-file-transmission/CISA added CVE-2026-46817 to KEV on Wednesday: unauthenticated CVSS 9.8 takeover of Oracle E-Business Suite Payments. Oracle's May 2026 CPU already has the fix.Wed, 15 Jul 2026 23:20:00 GMTOraclearticle