Critical security advisoryCriticalFlagged by our vulnerability database: PHP2Shell is on CISA’s exploited list. Most WordPress hosting runs PHP. See if your site is affectedFlagged by our vulnerability database: PHP2Shell is being exploited. DetailsExploited: PHP2Shell. Check your site
HuttenlocherTechnologies
843-331-6339
Start a project →
Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,764exploited flaws on CISA’s list
35added in the last 30 days
456new WordPress flaws this week
390,714entries in the database

3,294 results · page 10 of 66

  • Jun 17, 2026Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core).CVE-2026-46780 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8

    Vulnerability in the WebCenter Content: Imaging product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise WebCenter Content: Imaging. Successful attacks of this vulnerability can result in takeover of WebCenter Content: Imaging. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

    Product
    WebCenter Content: Imaging
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).CVE-2026-46779 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9

    Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3 to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

    Product
    Oracle WebCenter Enterprise Capture
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).CVE-2026-46778 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 10

    Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via RMI to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

    Product
    Oracle WebCenter Enterprise Capture
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).CVE-2026-46777 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.1

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

    Product
    Oracle WebCenter Content
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer).CVE-2026-46767 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9

    Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

    Product
    Oracle WebCenter Portal
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).CVE-2026-46766 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.8

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

    Product
    Oracle WebCenter Content
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer).CVE-2026-46765 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9

    Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Portal. While the vulnerability is in Oracle WebCenter Portal, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Portal. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

    Product
    Oracle WebCenter Portal
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).CVE-2026-35327 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.6

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data as well as unauthorized update, insert or delete access to some of Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 7.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N).

    Product
    Oracle WebCenter Content
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).CVE-2026-35326 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.2

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

    Product
    Oracle WebCenter Content
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).CVE-2026-35325 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

    Product
    Oracle WebCenter Content
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).CVE-2026-35324 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

    Product
    Oracle WebCenter Content
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).CVE-2026-35323 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

    Product
    Oracle WebCenter Content
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).CVE-2026-35322 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

    Product
    Oracle WebCenter Content
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).CVE-2026-35321 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

    Product
    Oracle WebCenter Content
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).CVE-2026-35320 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H).

    Product
    Oracle WebCenter Content
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).CVE-2026-35319 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.8

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

    Product
    Oracle WebCenter Content
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).CVE-2026-35318 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8

    Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

    Product
    Oracle WebCenter Sites
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).CVE-2026-35317 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

    Product
    Oracle WebCenter Content
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).CVE-2026-35316 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

    Product
    Oracle WebCenter Content
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).CVE-2026-35315 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 8.8

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

    Product
    Oracle WebCenter Content
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).CVE-2026-35296 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.8

    Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

    Product
    Oracle WebCenter Sites
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).CVE-2026-35295 · Other software · Oracle Corporation · reported by secalert_us@oracle.comHigh 7.5

    Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 7.5 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

    Product
    Oracle WebCenter Sites
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).CVE-2026-35293 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.8

    Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Sites. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Sites. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

    Product
    Oracle WebCenter Sites
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).CVE-2026-35286 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.8

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

    Product
    Oracle WebCenter Content
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).CVE-2026-35285 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9

    Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

    Product
    Oracle WebCenter Enterprise Capture
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).CVE-2026-35284 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9

    Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

    Product
    Oracle WebCenter Enterprise Capture
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).CVE-2026-35283 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9

    Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

    Product
    Oracle WebCenter Enterprise Capture
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).CVE-2026-35282 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9

    Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

    Product
    Oracle WebCenter Enterprise Capture
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).CVE-2026-35281 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9

    Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

    Product
    Oracle WebCenter Enterprise Capture
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).CVE-2026-35280 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.9

    Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via T3, IIOP to compromise Oracle WebCenter Enterprise Capture. While the vulnerability is in Oracle WebCenter Enterprise Capture, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Enterprise Capture. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

    Product
    Oracle WebCenter Enterprise Capture
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 17, 2026Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).CVE-2026-35270 · Other software · Oracle Corporation · reported by secalert_us@oracle.comCritical 9.1

    Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. While the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).

    Product
    Oracle WebCenter Content
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordoracle.com

  • Jun 16, 2026Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access Center allows Cross-SitCVE-2026-12425 · Other software · PowerSchool · reported by psirt@paloaltonetworks.comMedium 5.7

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access Center allows Cross-Site Scripting (XSS). This issue affects Employee Access Center: 23.10. It is possible to add in javascript code after the login URL and have it be eval()'d in the page and execute in the context of the user.

    Product
    Employee Access Center
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.com

  • Jun 16, 2026Dell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution vulnerability in the gateway plugin.CVE-2024-24909 · Other software · Dell · reported by security_alert@emc.comHigh 8.8

    Dell OpenManage Integration with Microsoft Windows Admin Center contains a Remote Code Execution vulnerability in the gateway plugin. A remote authenticated user could potentially exploit this vulnerability to escalate privileges. The malicious user may gain the ability to run arbitrary code remotely. This is a high severity vulnerability so Dell recommends customers to upgrade at the earliest opportunity.

    Product
    OpenManage
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recorddell.com

  • Jun 12, 2026Insufficient Verification of Data Authenticity in Remote Control for Zoom Contact Center for Windows before version 7.0.0 may allow an authenticated user to enaCVE-2026-53406 · Other software · Zoom Communications · reported by security@zoom.usHigh 7.8

    Insufficient Verification of Data Authenticity in Remote Control for Zoom Contact Center for Windows before version 7.0.0 may allow an authenticated user to enable an escalation of privilege via local access.

    Product
    Remote Control for Zoom Contact Center
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordzoom.com

  • Jun 10, 2026A path traversal vulnerability has been reported to affect License Center.CVE-2025-62851 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 4.6

    A path traversal vulnerability has been reported to affect License Center. If a local attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: License Center 1.9.56 and later

    Product
    License Center
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordqnap.com

  • Jun 9, 2026A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center.CVE-2025-58468 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 5.1

    A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center. The remote attackers can then exploit the vulnerability to gain privileges or hijack user identities. We have already fixed the vulnerability in the following version: Notification Center 1.10.0.3291 and later

    Product
    Notification Center
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordqnap.com

  • Jun 9, 2026CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side file contents when an CVE-2026-8045 · Other software · Schneider Electric · reported by cybersecurity@se.comHigh 7.1

    CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that could cause information disclosure of server-side file contents when an attacker with a Data Center Expert user account submits crafted XML payloads to SOAP service endpoints.

    Product
    EcoStruxure™ IT Data Center Expert
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recorddownload.schneider-electric.com

  • Jun 5, 2026HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center.CVE-2026-21825 · Other software · HCLSoftware · reported by psirt@hcl.comMedium 6.1

    HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center.  An attacker could execute arbitrary JavaScript in the victim's browser.

    Product
    DX Compose
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsupport.hcl-software.com

  • Jun 2, 2026A high security vulnerability affecting Security Center main server installations has been identified.CVE-2026-40619 · Other software · Genetec Inc. · reported by security@genetec.comHigh 7.8

    A high security vulnerability affecting Security Center main server installations has been identified. It could allow an attacker with local OS privileges to the main server to access the Server Admin credentials. A third party hired by Genetec found the issue. There is currently no evidence of active exploitation. This vulnerability is associated with specific installation package builds rather than the product version identifier alone. Certain versions (including 5.10.4.0, 5.11.3.0, 5.12.2.0 and 5.13.3.0) were released with both vulnerable and remediated installation packages under the same version number. Consequently, version-based comparison alone is insufficient to determine exposure. Only installations performed using vulnerable builds are affected. Remediated builds can be distinguished using verified installation package hashes. For the complete list of fixed build hashes, refer to the security advisory section.

    Product
    Genetec Security Center
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordresources.genetec.com

  • May 29, 2026Service Center developed by BankPro E-Service Technology has an Insecure Direct Object Reference vulnerability, allowing authenticated remote attackers to modifCVE-2026-9493 · Other software · BankPro E-Service Technology · reported by twcert@cert.org.twHigh 7.1

    Service Center developed by BankPro E-Service Technology has an Insecure Direct Object Reference vulnerability, allowing authenticated remote attackers to modify the parameter of a specific query function to access other users' EC order details.

    Product
    Service Center
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordtwcert.org.twtwcert.org.tw

  • May 27, 2026Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote aCVE-2025-12686 · Network & remote access · Synology · reported by security@synology.comCritical 9.8

    Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote attackers to execute arbitrary code via unspecified vectors.

    Product
    BeeStation OS
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordsynology.com

  • May 26, 2026Missing password field masking vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view, Hitachi Ops Center Analyzer probe modules)CVE-2026-3314 · Other software · Hitachi · reported by hirt@hitachi.co.jpMedium 4.6

    Missing password field masking vulnerability in Hitachi Ops Center Analyzer (Hitachi Ops Center Analyzer detail view, Hitachi Ops Center Analyzer probe modules), Hitachi Ops Center Analyzer viewpoint, Hitachi Infrastructure Analytics Advisor (Data Center Analytics, Analytics probe modules). This issue affects Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.8-00; Hitachi Ops Center Analyzer viewpoint: from 10.8.1-00 before 11.0.8-00; Hitachi Infrastructure Analytics Advisor: from 3.2.0-00 before 11.0.8-00.

    Product
    Hitachi Ops Center Analyzer
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordhitachi.com

  • May 25, 2026SQL Injection affecting the Access Manager role.CVE-2026-27768 · Other software · Genetec Inc. · reported by security@genetec.comMedium 6.6

    SQL Injection affecting the Access Manager role.

    Product
    Genetec Security Center
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordtechdocs.genetec.comtechdocs.genetec.com

  • May 25, 2026A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor.CVE-2026-9490 · Other software · Acer · reported by 8fc372e3-d9c5-46e4-9410-38469745c639Medium 6.8

    A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a weak Security Descriptor. This vulnerability allows an authenticated local user to connect and send a specially crafted message (message type 0x03) to the pipe, causing the service to crash with exit code 1067 (ERROR_PROCESS_ABORTED). To mitigate this potential local service disruption, Acer requires users to update the software to the latest version.

    Product
    Care Center
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordcommunity.acer.com

  • May 20, 2026Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.CVE-2026-42834 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8

    Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

    Product
    Windows Admin Center in Azure Portal
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordmsrc.microsoft.com

  • May 20, 2026A broken access control issue has been identified in the Talend Administration Center, that allows a user with “View” permission to modify the Talend Studio updCVE-2026-9057 · Other software · Talend · reported by 4ac701fe-44e9-4bcd-9585-dd6449257611High 8.2

    A broken access control issue has been identified in the Talend Administration Center, that allows a user with “View” permission to modify the Talend Studio update URL. This issue was resolved in a patch, which is already available.

    Product
    Talend Administration Center
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordcommunity.qlik.com

  • May 20, 2026A stored cross-site scripting vulnerability has been found in the Talend Administration Center.CVE-2026-9056 · Other software · Talend · reported by 4ac701fe-44e9-4bcd-9585-dd6449257611Medium 5.4

    A stored cross-site scripting vulnerability has been found in the Talend Administration Center. An attacker with permission to manage servers can store a XSS payload that can be triggered by a different user.

    Product
    Talend Administration Center
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordcommunity.qlik.com

  • May 12, 2026PowerSYSTEM Center feature for device project groups allows an authenticated user with limited permissions to perform an unauthorized deletion of project groupsCVE-2026-35555 · Other software · Subnet Solutions · reported by ics-cert@hq.dhs.govHigh 7

    PowerSYSTEM Center feature for device project groups allows an authenticated user with limited permissions to perform an unauthorized deletion of project groups.

    Product
    PowerSYSTEM Center 2024
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comcisa.gov

  • May 12, 2026PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access information normally limited by operational permissions.CVE-2026-33570 · Other software · Subnet Solutions · reported by ics-cert@hq.dhs.govMedium 6.9

    PowerSYSTEM Center REST API endpoint for devices allows a low privilege authenticated user to access information normally limited by operational permissions.

    Product
    PowerSYSTEM Center 2020
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comcisa.gov

  • May 12, 2026PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive information normally reCVE-2026-26289 · Other software · Subnet Solutions · reported by ics-cert@hq.dhs.govHigh 8.4

    PowerSYSTEM Center REST API endpoint for device account export allows an authenticated user with limited permissions to expose sensitive information normally restricted to administrative permissions only.

    Product
    PowerSYSTEM Center 2020
    What to do
    Apply the vendor’s update. The NVD record links to the advisory.

    Full record and what to do →NVD recordgithub.comcisa.gov

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Get in touch

Tell us what you're building.

A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.

01The person who'll do the work writes back
02A short call, then a written plan with the price
03Nothing starts until you say yes
04Hacked or down right now? Call, and we pick up the same day
843-331-6339

Not ready to talk yet? Run the free website check and see what Google sees.

What do you need?
Build
Grow
Protect
Urgent

No newsletter, no sales sequence. Just a reply.