CVE-2026-34321
published 2026-04-21CVE-2026-34321: Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: User…
PriorityP426medium4.8CVSS 3.1
AVNACHPRLUIRSUCHINAN
EPSS
0.25%
16.0th percentile
Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: User Interface). Supported versions that are affected are 8.0.7.9, 8.0.8.7 and 8.1.2.5. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Financial Services Analytical Applications Infrastructure. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Financial Services Analytical Applications Infrastructure accessible data. CVSS 3.1 Base Score 4.8 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N).
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| oracle | financial_services_analytical_applications_infrastructure | — | — |
| oracle | financial_services_analytical_applications_infrastructure | — | — |
| oracle | financial_services_analytical_applications_infrastructure | — | — |
| oracle_corporation | oracle_financial_services_analytical_applications_infrastructure | — | — |
| oracle_corporation | oracle_financial_services_analytical_applications_infrastructure | — | — |
| oracle_corporation | oracle_financial_services_analytical_applications_infrastructure | — | — |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N
vendor_redhat3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-102699 xen: xen: Denial of Service via integer underflow during cache flushing [fedora-all]
bugzilla·2026-10-21·CVSS 3.3
CVE-2026-102699 [LOW] CVE-2026-102699 xen: xen: Denial of Service via integer underflow during cache flushing [fedora-all]
CVE-2026-102699 xen: xen: Denial of Service via integer underflow during cache flushing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
1) XSA-437 (CVE-2023-34321) addressed issues with overflows in
calculations involved in guests flushing caches through
GNTTABOP_cache_flush. Unfortunately the fix there introduced a
calculation which may underflow, resulting in a loop which would - at
least on 64-bit Arm - take excessively long, and which would likely
eventually crash the hy
Bugzilla
CVE-2026-102699 xen: xen: Denial of Service via integer underflow during cache flushing
bugzilla·2026-10-13·CVSS 3.3
CVE-2026-102699 [LOW] CVE-2026-102699 xen: xen: Denial of Service via integer underflow during cache flushing
CVE-2026-102699 xen: xen: Denial of Service via integer underflow during cache flushing
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
1) XSA-437 (CVE-2023-34321) addressed issues with overflows in
calculations involved in guests flushing caches through
GNTTABOP_cache_flush. Unfortunately the fix there introduced a
calculation which may underflow, resulting in a loop which would - at
least on 64-bit Arm - take excessively long, and which would likely
eventually crash the hypervisor.
This is CVE-2026-102699.
2) GNTTABOP_cache_flush may be issued on memory mapped from another
domain using the grant table interface. However there was no
restriction to disallow the use of invalidate-without-clean against
read
2026-04-21
Published