Vulnarycritical

the critical ledger · updated hourly

Critical vulnerability intelligence.

New critical security flaws land every day. Vulnary tells you what each one actually is, who it hits, how serious it really is, and the exact steps to shut it down.

Browse the feed ↓Am I affected? →

scroll

1,694critical tracked/57new today/31known-exploited/0exploit available/1,694critical tracked/57new today/31known-exploited/0exploit available/1,694critical tracked/57new today/31known-exploited/0exploit available/1,694critical tracked/57new today/31known-exploited/0exploit available/

The feed (latest)

1,694 entries

Your stack

Add the software you run to see what affects you.

view

source

fromto

CVE-2026-61178

Oracle Agile Product Lifecycle Management For Process

A critical flaw in Oracle Agile Product Lifecycle Management for Process (version 6.2.4) lets anyone on the network take full control of the system. The vulnerability is easy to exploit and requires no special access or user interaction. It can compromise data confidentiality, integrity, and availability.

Critical· 9.8<1% likely

published 11d agodeletes in 35d

CVE-2026-61175

A critical vulnerability exists in the Oracle Product Lifecycle Analytics product within Oracle Supply Chain. An attacker can exploit this flaw via a network connection to gain unauthorized access to sensitive information.

Critical· 9.3<1% likely

published 11d agodeletes in 35d

CVE-2026-61174

A critical flaw in Oracle Product Lifecycle Analytics 3.6.1 lets anyone who can log onto the same infrastructure as the product gain full control over the application. The bug can be used to create, delete, or change any data stored in the system, and to read all data. It is easy to exploit and requires no special privileges.

Critical· 9<1% likely

published 11d agodeletes in 35d

CVE-2026-61171

Oracle Agile Plm

A critical flaw in Oracle Agile PLM 9.3.6 lets anyone on the network create, delete, or read data without authentication. The vulnerability is easy to exploit and can expose or alter all data stored in the system.

Critical· 9.1<1% likely

published 11d agodeletes in 35d

CVE-2026-61167

Oracle Agile Plm

A critical flaw in Oracle Agile PLM version 9.3.6 lets anyone on the network take full control of the system. The vulnerability can be triggered without authentication or user interaction, and it affects confidentiality, integrity, and availability.

Critical· 9.8<1% likely

published 11d agodeletes in 35d

CVE-2026-61161

Oracle Commerce Experience Manager +1 more

Oracle Commerce Guided Search and Experience Manager version 11.4.0 contains a critical flaw that lets anyone with network access send HTTP requests to take full control of the system. The vulnerability can be exploited without authentication or user interaction, allowing attackers to compromise confidentiality, integrity, and availability.

Critical· 9.8<1% likely

published 11d agodeletes in 35d

CVE-2026-61156

A critical flaw in Oracle Commerce Guided Search Platform Services (version 11.4.0) lets anyone on the network create, delete, or change data without authentication. The vulnerability can be triggered over HTTPS and gives attackers full control over the service’s data.

Critical· 9.1<1% likely

published 11d agodeletes in 35d

CVE-2026-61155

A critical vulnerability exists in the Oracle Commerce Guided Search Platform Services (Forge component). It allows an attacker to access sensitive data or crash the service without needing any login credentials.

Critical· 9.1<1% likely

published 11d agodeletes in 35d

CVE-2026-61154

Oracle Commerce Guided Search Platform Services (Forge component) version 11.4.0 has a critical flaw that lets anyone on the network take full control of the service via HTTP. An attacker could read, modify, delete data, and disrupt the service.

Critical· 9.8<1% likely

published 11d agodeletes in 35d

CVE-2026-61153

Oracle Commerce Experience Manager +1 more

A critical vulnerability exists in the Oracle Commerce Guided Search and Oracle Commerce Experience Manager components. This flaw allows an attacker to gain unauthorized access to the system via the network without needing any login credentials.

Critical· 9.1<1% likely

published 11d agodeletes in 35d

CVE-2026-61146

Oracle Commerce Experience Manager +1 more

A critical flaw in Oracle Commerce Guided Search / Oracle Commerce Experience Manager (version 11.4.0) lets a low‑privileged attacker compromise the system over HTTP. The vulnerability can be exploited without user interaction and can lead to full takeover of the application.

Critical· 9.9<1% likely

published 11d agodeletes in 35d

CVE-2026-61145

Oracle Commerce Experience Manager +1 more

Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 has a critical flaw that lets anyone on the network take full control of the system. The vulnerability can be exploited without authentication or user interaction.

Critical· 9.8<1% likely

published 11d agodeletes in 35d

CVE-2026-61140

Oracle Webcenter Sites

A critical vulnerability (CVSS 9.8) affects Oracle WebCenter Sites version 14.1.2.0.0. An unauthenticated attacker with network access via HTTP can exploit it to take full control of the system. No official fix is documented in the provided sources.

Critical· 9.8<1% likely

published 11d agodeletes in 35d

CVE-2026-61131

Oracle Commerce Platform

A critical flaw in Oracle Commerce Platform 11.4.0 allows attackers to take full control of the system without authentication. The vulnerability is in the Dynamo Application Framework component and can be triggered over HTTP. It can compromise all data and services on the platform.

Critical· 9.8<1% likely

published 11d agodeletes in 35d

CVE-2026-61130

Oracle Commerce Platform

A critical flaw in Oracle Commerce Platform’s Dynamo Application Framework (version 11.4.0) allows anyone on the network to send a crafted HTTP request that gives full access to the platform’s data or causes it to crash. The vulnerability is easy to exploit and requires no authentication or user interaction.

Critical· 9.1<1% likely

published 11d agodeletes in 35d

CVE-2026-61129

Oracle Commerce Platform

A critical flaw in Oracle Commerce Platform 11.4.0 lets anyone on the network take full control of the system. The bug is easy to exploit and requires no authentication or special user interface. It can be used to steal data, modify content, or shut down services.

Critical· 9.8<1% likely

published 11d agodeletes in 35d

CVE-2026-61100

Oracle Webcenter Enterprise Capture +1 more

Oracle WebCenter Enterprise Capture is vulnerable to a critical flaw that lets anyone on the network send a crafted HTTP request and take over the application. The issue affects versions 12.2.1.4.0 and 14.1.2.0.0. An attacker can gain full control without authentication.

Critical· 9.8<1% likely

published 11d agodeletes in 35d

CVE-2026-61097

A critical flaw in Oracle Banking Trade Finance Process Management lets an unauthenticated attacker with network access manipulate data and cause partial denial of service. The vulnerability requires the victim to interact with the attacker but can be triggered by a human other than the attacker. It affects versions 14.6.0 through 14.8.0.

Critical· 9.6<1% likely

published 11d agodeletes in 35d