ZeroPath Blog & Research
Explore our team's latest research and stay up to date with ZeroPath's capabilities.
CVE Analysis
•2026-05-28
•10 min read
Oracle Hospitality OPERA 5 CVE-2026-34311: Brief Summary of a Critical Unauthenticated Takeover Vulnerability
A brief summary of CVE-2026-34311, a CVSS 9.8 unauthenticated takeover vulnerability in Oracle Hospitality OPERA 5 Property Services that affects five supported versions across the 5.6.x release family.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•10 min read
Oracle REST Data Services CVE-2026-35277: Brief Summary of a High Severity Data Access Vulnerability in the Core Component
A short review of CVE-2026-35277, a CVSS 8.1 vulnerability in Oracle REST Data Services that lets low-privileged attackers read and modify critical data across all ORDS-accessible resources over HTTPS.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•8 min read
Brief Summary: Kibana CVE-2026-42398 SSRF Allowlist Bypass via Webhook Connector
A short review of CVE-2026-42398, a high-severity SSRF vulnerability in Kibana that lets authenticated users bypass the operator-configured connection allowlist with crafted Webhook connectors, and where it fits in the pattern of recurring Kibana SSRF bugs in 2026.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•10 min read
Samba CVE-2026-4408: Overview of Unauthenticated Remote Code Execution via SAMR Password Script Injection
CVE-2026-4408 is a critical unauthenticated remote code execution vulnerability in Samba's SAMR server, caused by unescaped shell meta-characters in the check password script feature. This post covers patch details and affected versions.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•10 min read
Brief Summary: CVE-2026-46775 Oracle REST Data Services Core Component Takeover with Scope Change (CVSS 9.9)
A short review of CVE-2026-46775, a CVSS 9.9 vulnerability in the Oracle REST Data Services (ORDS) Core component. It lets a low-privileged attacker take over ORDS completely, and the scope change could extend the compromise to connected Oracle Database instances and downstream services.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•10 min read
Oracle E-Business Suite CVE-2026-46817: Brief Summary of a Critical Unauthenticated Payments Takeover
A brief summary of CVE-2026-46817, a CVSS 9.8 unauthenticated vulnerability in Oracle E-Business Suite's Payments File Transmission component that affects versions 12.2.3 through 12.2.15. It also covers threat-actor interest in Oracle EBS and the companion vulnerability CVE-2026-46818.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•10 min read
Brief Summary: CVE-2026-46819 — Unauthenticated Data Access in Oracle E-Business Suite Internet Procurement Connector
A short review of CVE-2026-46819, a CVSS 9.1 vulnerability in Oracle E-Business Suite's Internet Procurement Connector that lets an unauthenticated attacker read and manipulate critical procurement data over HTTP. Includes patch information from Oracle's inaugural monthly CSPU.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•10 min read
Overview of CVE-2026-46820: Oracle E-Business Suite Financials Common Modules Scope Change Vulnerability
A brief summary of CVE-2026-46820, a high-severity vulnerability (CVSS 8.5) in Oracle Financials Common Modules. A low-privileged attacker can use it to access critical financial data and, through a scope change, affect additional products. It arrives amid sustained threat actor targeting of the Oracle EBS platform.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•10 min read
Quick Look: CVE-2026-46821 — Oracle EBS Financials Common Modules Confidentiality Breach with Scope Change
CVE-2026-46821 is a high-severity confidentiality vulnerability in Oracle E-Business Suite Financials Common Modules (versions 12.2.3 through 12.2.15). A low-privileged attacker can use it to access critical data across multiple EBS products. This summary also covers the patch, which shipped in Oracle's first monthly CSPU release.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•10 min read
Brief Summary: CVE-2026-46822 Oracle iAssets Critical Takeover Vulnerability (CVSS 9.9) in E-Business Suite
A short review of CVE-2026-46822, a CVSS 9.9 vulnerability in Oracle iAssets (E-Business Suite) that lets a low-privileged attacker achieve full system takeover, with a scope change that reaches adjacent EBS modules. Covers technical details, threat context from Cl0p's earlier exploitation of Oracle EBS, and mitigation guidance.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•10 min read
Oracle E-Business Suite CVE-2026-46824: Brief Summary of a 9.9 CVSS Universal Work Queue Takeover
A brief summary of CVE-2026-46824, a vulnerability of near-maximum severity in Oracle E-Business Suite's Universal Work Queue. It lets a low-privileged attacker take over the full application, and the impact crosses into other components.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•10 min read
Oracle Payroll CVE-2026-46826: Brief Summary of a High Severity Takeover Vulnerability in E-Business Suite
A brief summary of CVE-2026-46826, a CVSS 8.8 vulnerability in the Internal Operations component of Oracle Payroll that lets a low-privileged attacker take over Oracle Payroll completely on E-Business Suite versions 12.2.3 through 12.2.15.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•10 min read
Oracle Payroll Self Service Manager CVE-2026-46827: Brief Summary of a CVSS 8.8 Privilege Escalation to Full Takeover
A brief summary of CVE-2026-46827, a CVSS 8.8 authorization bypass in Oracle E-Business Suite's Payroll Self Service Manager component. A low-privileged authenticated attacker can use it to take over Oracle Payroll in versions 12.2.3 through 12.2.15.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•9 min read
Quick Look: CVE-2026-46833 — Oracle Database Net Service TLS Takeover with Scope Change
A brief summary of CVE-2026-46833, a CVSS 9.0 vulnerability in Oracle Database Net Service that lets unauthenticated attackers achieve full takeover via TLS, with impact that extends beyond the vulnerable component to additional products.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•8 min read
Oracle Database Net Service CVE-2026-46834: Brief Summary of Unauthenticated TLS Denial of Service
CVE-2026-46834 is a CVSS 7.5 denial-of-service vulnerability in Oracle Database Net Service. An unauthenticated attacker can crash or hang the service over TLS. It affects every Oracle Database 23ai version from 23.4.0 through 23.26.2.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•7 min read
Oracle REST Data Services CVE-2026-46840: Overview of a CVSS 10.0 Unauthenticated Takeover Vulnerability
CVE-2026-46840 is a maximum-severity (CVSS 10.0) vulnerability in Oracle REST Data Services. It allows unauthenticated remote takeover via HTTPS, and its changed scope means the impact reaches connected databases and applications.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•7 min read
TinyMCE CVE-2026-47759: Overview of Stored XSS via Internal data-mce-* Attribute Abuse
CVE-2026-47759 is a stored XSS vulnerability in TinyMCE that bypasses sanitization through crafted data-mce-* attributes. This post covers the patch details and the affected versions.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•10 min read
TinyMCE CVE-2026-47760: Overview of Nested SVG Sanitizer Bypass Leading to Stored XSS
CVE-2026-47760 is a high-severity stored XSS vulnerability in TinyMCE, caused by improper SVG namespace scope handling in the sanitizer. It affects versions 6.8.0 through 7.0.x.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•8 min read
TinyMCE CVE-2026-47761: Overview of a High Severity Stored XSS via Media Plugin data-mce-object Injection
CVE-2026-47761 is a stored XSS vulnerability in TinyMCE's media plugin that scores 8.7 CVSS. It affects all versions prior to 5.11.1, 7.9.3, and 8.5.1, and the entire 6.x branch is permanently unpatched because it has reached end of life.
ZeroPath CVE Analysis
CVE Analysis
•2026-05-28
•10 min read
TinyMCE CVE-2026-47762: Overview of Stored XSS via Forged mce:protected Comments
CVE-2026-47762 is a stored XSS vulnerability in TinyMCE that lets attackers bypass sanitization by forging mce:protected comments. This summary covers the patch and the affected version ranges across four major release lines.
ZeroPath CVE Analysis
