CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Oracle HTTP Server & WebLogic Server Proxy Plug-in Critical Vulnerability Advisory (CVE-2026-21962)
[Affected Scope] Oracle HTTP Server and WebLogic Server Proxy Plug-in (for Apache HTTP Server and IIS) versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 within Oracle Fusion Middleware.
[Impact] Unauthenticated remote attackers can exploit this vulnerability via HTTP to compromise the server, leading to unauthorized data modification, deletion, or complete system takeover with potential scope expansion to backend systems (CVSS 10.0).
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately, restrict network access, and deploy WAF rules to filter malicious HTTP headers.
Grafana Unauthenticated Snapshot Data Exposure and Deletion Vulnerability (CVE-2021-39226)
[Affected Scope] Grafana versions prior to 8.1.6 and 7.5.11
[Impact] Unauthenticated attackers can view or delete the snapshot with the lowest database key via specific API paths, potentially leading to complete snapshot data harvesting and loss.
[Mitigation] Immediately upgrade Grafana to patched versions (8.1.6, 7.5.11, or higher) or block access to the vulnerable API paths using a reverse proxy.
Oracle Fusion Middleware BI Publisher Security Bypass and Data Modification/Disclosure Vulnerability (CVE-2019-2616) Analysis and Mitigation Guide
[Affected Scope] Oracle Fusion Middleware BI Publisher (formerly XML Publisher) versions 11.1.1.9.0, 12.2.1.3.0, and 12.2.1.4.0
[Impact] Unauthenticated remote attackers can read, update, insert, or delete sensitive data via HTTP, potentially impacting connected downstream systems
[Mitigation] Apply the official Oracle Critical Patch Update (CPU) immediately and restrict access to BI Publisher endpoints using a WAF or reverse proxy